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PREFACE AND PURPOSE 


The Privacy Act (Revised Statutes of Canada, Chapter A-1, 1985) was proclaimed on 
July 1, 1983. 


The purpose of the Privacy Act “is to extend the present laws of Canada that protect the privacy 
of individuals with respect to personal information about themselves held by a government 
institution and that provide individuals with a right of access to that information” (Section 2 of 
the Act). The law also protects an individual’s privacy by preventing others from having access 
to personal information, and it allows an individual specific rights concerning the collection and 
use of his/her information. 


Section 72 of the Privacy Act requires that the head of every government institution prepare for 
submission to Parliament an annual report on the administration of this Act within the institution 
during each financial year. 


This annual report describes how Industry Canada administered its responsibilities in the twenty- 
fifth year of operation of the Privacy Act. 


ABOUT THE ORGANIZATION 


Industry Canada’s Mandate 


Industry Canada’s mandate is to help make Canadians more productive and competitive in the 
knowledge-based economy, thus improving the standard of living and quality of life in Canada. 
The department’s policies, programs and services help grow a dynamic and innovative economy 
that: 


» provides more and better-paying jobs for Canadians 

> supports stronger business growth through continued improvements in 
productivity and innovation performance 

> gives consumers, businesses and investors confidence that the marketplace is fair, 
efficient and competitive 

> ensures a more sustainable economic, environmental and social future for 
Canadians 


Industry Canada aims to help Canadians contribute to the knowledge economy and improve 
productivity and innovation performance through its three strategic objectives: 


> a fair, efficient and competitive marketplace 
> an innovative economy 
> a competitive industry and sustainable communities 


For more information about Industry Canada’s initiatives, please visit www.ic.gc.ca. 


Departmental Structure 


In 2007, Industry Canada performed minor restructuring to better meet its mandate and respond 


to the government’s priorities. See the attached department structure in Appendix II (also 
available on our website). 


Delegation of Authority 


In 2007, the Access to Information and Privacy (ATIP) Delegation Order was revised and 
approved by the new Minister. Full delegated authority is provided to the Assistant Deputy 
Minister of Small Business and Marketplace Services Sector, and the Director and the Manager 
(previously titled Deputy Director) of Information and Privacy Rights Administration (IPRA) 


(see Appendix IV). For the daily ATIP operations, both the Director and the Manager exercise 
full responsibility. 


Information and Privacy Rights Administration 


The IPRA (also referred to as the ATIP Office) is under the responsibility of the Information 
Management Branch, Small Business and Marketplace Services Sector. The Director and the 
Manager of IPRA have been delegated the authority to exercise full powers under the Access to 
Information Act and the Privacy Act. The Director is responsible for the development, 
coordination and implementation of effective policies, guidelines and procedures to manage the 
department’s compliance with these Acts. The administration of the legislation in Industry 
Canada is also facilitated at the branch and regional office levels. Each organizational sector has 
a Liaison Officer (reporting to an Assistant Deputy Minister, Regional Executive Director, etc.) 
who coordinates activities and provides guidance on the administrative processes and procedures 
of the Acts. IPRA, which is located in Ottawa, responds to all formal requests submitted under 
the Acts. For daily operational purposes, the IPRA Director reports to the Director General of 
the Information Management Branch. For the purposes of the ministerial delegated authority on 
ATIP matters, the IPRA Director reports directly to the Assistant Deputy Minister of Small 
Business and Marketplace Services, who in turn reports to the Deputy Minister. 


IPRA makes decisions on the disposition of access requests; promotes awareness of the 
legislation to ensure departmental responsiveness to the obligations imposed by law; monitors 
and advises on departmental compliance with the Acts, regulations, procedures and policies; and 
acts as the spokesperson for the Department in dealings with the Treasury Board Secretariat, the 
Information Commissioner, the Privacy Commissioner, and other government departments and 
agencies. IPRA is responsible for conducting consultations with other federal departments with 
respect to access to information and privacy issues. 


With respect to its organization, IPRA has a complement of 15 employees comprising a director, 
a manager, 11 advisors and 2 support staff, all of whom are dedicated to processing access and 
privacy requests, along with other related functions. 


Consistent with many ATIP offices, IPRA continued to face challenges in recruiting, developing 
and retaining staff in 2007-08. Of the 15 IPRA positions, only 11 were staffed for the majority 
of the reporting period. The 11 staffed positions consisted of the director, a manager in 
development, three senior advisors (PM-05 level) and six positions at the PM-03 level or lower. 
The more junior staff were, for the most part, in development. During part of the reporting 
period, a consultant was hired to help with the workload. See the attached organizational 
structure (Appendix III). 


2007—08 Highlights 


Workload 


In 2007-08, the Department received six privacy requests and carried forward one eaness from 
the previous year. 


Education and Training Activities 


IPRA prepared and delivered 13 ATIP training and awareness sessions to departmental 
employees within the National Capital Region, with an average attendance of 25 employees per 
session. Upon request, sessions may be tailored to suit the needs of a specific group. In addition 
to these formal sessions, an intranet site is used to create awareness and disseminate information 
to employees. 


ATIP — Professional Development Program 


In 2005, Industry Canada launched the ATIP — Professional Development Program (ATIP- 
PDP) to develop employees from the PM-01 to the PM-04 level within the ATIP function. The 
program’s objective is to provide managed training and development in the acquisition of 
knowledge of ATIP legislation, policy and directives, and to develop other core competencies 
that are needed now and in the future. Participants progressively acquire new competencies to 
meet both statutory and institutional needs, while maintaining and enhancing existing 
competencies to meet operational needs. Upon completion of the program, participants are fully 
functioning ATIP specialists (PM-04 or equivalent). 


There have been four participants in the ATIP-PDP. One has graduated to the PM-04 level, 
another left the program to take on a new position outside of the ATIP environment, and two are 
currently in development at the PM-03 level. In the longer term, it is expected that the ATIP- 
PDP will contribute to employee retention and allow for better succession planning. 


Policies and Procedures 


Industry Canada ensures that Treasury Board policies are implemented, either through internal 
departmental policies and/or directives and guidelines. 


Use of CDs 


Since 2002-03, the Department has provided CDs containing the images of the processed 
records in response to all requests received pursuant to both the Access to Information Act and 
the Privacy Act. This initiative has reduced paperwork burden and eliminated reproduction fees 
and on-site visits from applicants, as well as improved timeliness and efficiency in managing the 
ATIP program and services. The Department does not charge for CDs. 


Formal and Informal Practices 


Consistent with the principle that the Act is intended to complement, rather than replace, 
existing procedures for access to personal information, informal requests may be addressed 
directly to branches within the Department. The IPRA routinely directs requestors to the relevant 
sectors. Formal requests are processed by IPRA. | 


ATIP Website 
IPRA has its own Internet site (www.ic.gc.ca/emb/welcomeic.nsf/ICPages/ 


AccessToInformation). The site contains general information, points of contacts and links to 
other key departments and agencies, including the ATIP Offices for the Industry Portfolio. 


Info Source 


IPRA is responsible for providing a full accounting of the department’s information holdings to 
the Treasury Board Secretariat, and it ensures that updates are provided on a timely basis for. 
inclusion in Info Source. Info Source contains a description of program records held by Industry 
Canada. This information may be found in the latest publications: 


b 2007-2008 Info Source — Sources of Federal Government Information 
> 2007-2008 Info Source — Sources of Federal Employee Information 


Info Source may be obtained through public and academic libraries, or may be viewed online at 
www.inforsource.gc.ca/index-eng.asp. 


Reading Rooms 


A reading room is available at Industry Canada headquarters and in all regional offices as 
required. Current departmental manuals are available for review upon request from the public or 
may be provided electronically. 


Privacy Impact Assessment (PIA) Policy 


The Department has implemented the Treasury Board Secretariat’s PIA Policy by developing 
and implementing general guidelines. Given that Industry Canada’s mandate revolves primarily 
around business and commercial information, there is little involvement with personal 
information. The guidelines established encourage program officials to complete a preliminary 
privacy impact assessment (PPIA). This tool allows program officials, when initiating a new 
initiative, program or service involving personal information, to define the type of personal 
information and the legal provision for its use and collection. Discussions are held with IPRA 
prior to finalizing the PPIA. If the conclusion is negative, no further action is required. If 
positive, then program officials may be required to complete a PIA and ensure that discussions 
are completed with IPRA, Legal and Chief Information Office officials, as required. 


Information Management Policy 
Retention and Disposal 


The Corporate Integrated Records Services of Industry Canada develops, in association with 
program officials, the retention periods to correspond with business, legal and accountability 
requirements and will dispose of records in accordance with the record disposition authorities 
approved by Library and Archives Canada. 


PRIVACY — TRENDS AND STATISTICS 


Industry Canada’s mandate is such that there are limited privacy requests and issues. IPRA, 
however, is responsible for providing advice and guidance on privacy issues, including the 

handling and protection of personal information gathered and held in departmental files, as 

required. 


Significant Trends 
Given the few official requests received during the reporting period, no significant trend was 


noted. The few privacy requests received most frequently involve Human Resources Branch or 
the Office of the Superintendent of Bankruptcy. 


Statistical Report — Interpretation and Explanation 


Appendix I provides a summarized statistical report on Privacy Act applications processed from 
April 1, 2007 to March 31, 2008. The following provides explanations and interpretations of 
information contained in this report. 


I. Requests Under the Privacy Act 


Of the seven privacy requests processed during this reporting period, six requests were new and 
one request was carried forward from the previous year. 


II. Disposition of Requests Completed 
Of the seven active requests, five requests were completed during the 2007-08 reporting period 
and two requests remained to be processed as of March 31, 2008. The completed requests are 
categorized as follows: 

All Disclosed — In two cases, the requesters were granted full access. 


Disclosed in Part — In two cases, the requesters were granted partial access. 


Unable to Process — None of the requests were unable to be processed by the 
Department. 


Abandoned by Applicant — None of the completed requests were abandoned by the 
applicant. 


Transferred — One of the five requests processed was for information that was not 
under the control of the Department. With consent of the applicant, the request was 
transferred to the appropriate government institution for processing. 


Il. Exemptions Invoked 


As noted in Appendix I, exemptions pursuant to sections 22, 25, 26 and 27 of the Privacy Act 
were invoked by the Department. 


IV. Exclusions Cited 

No exclusions were invoked by the Department. 

V. and VI. Completion Time and Extensions 

In four of the five cases processed, the Department was able to respond within legislated time 
periods. The Department was unable to respond within legal deadlines in one case as noted in 
Appendix I. 

VII. Translations 

No translations were undertaken in dealing with these requests. 


VIII. Method of Access 


Copies of the records were given or burned onto CDs in response to four requests (with one case 
being transferred), and no one sought the right of examination. 


IX. Corrections and Notation 

No requests for corrections or notation were received. 

X. Costs 

Total salary costs associated with administering the Privacy Act activities were estimated at 
$18 410 for this reporting period. Non-salary costs were estimated at $3607, for a total cost of 


$22 017. The associated human resources (includes both IPRA and departmental officials) 
required to fulfill this function were estimated at 0.30, less than one full-time employee. 


Complaints, Investigations and Appeals 


The Department did not receive any new complaints for this reporting period. Four complaints 
were carried forward from previous reporting periods since the investigations are still ongoing. 


There were no appeals to the Federal Court of Canada during this reporting period. 


Changes Resulting from Issues Raised by Officers of Parliament 


Office of the Privacy Commissioner of Canada 


Except for the few outstanding complaints noted above, there is nothing to report under this item 
for this reporting period. 


Office of the Auditor General of Canada 


There is nothing to report under this item for this reporting period. 


OTHER PRIVACY ACTIVITIES 


The intent and requirements of the Privacy Act and Treasury Board guidelines regarding the 
collection, use, disclosure, retention and disposal of personal information are outlined in 
departmental directives. Departmental employees are made aware of their responsibilities for the 
proper management of personal information holdings. Responsible sectors are also required to 
consult with IPRA before collecting any personal information. 

Furthermore, IPRA must be notified where personal information in a personal information bank 


is used or disclosed for a use consistent with the purpose for which the information was obtained 
or compiled, but was not identified in the statement of consistent uses published in Info Source. 


Privacy Impact Assessments and Preliminary Privacy Impact Assessments 


There were no PIAs or PPIAs initiated or completed during this reporting a Therefore, no 
PIAs were forwarded to the Office of the Privacy Commissioner. 


Disclosures Made Pursuant to Paragraph 8(2) — Permissible Disclosures 
Section 8(2)(e) — disclosure made to an investigative body (as described in the Regulations) 
One request was received from an investigative body, and the information was released pursuant 


to subsection 8(2)(e) of the Act during this reporting period. 


Section 8(2)(f) — disclosure under agreement or arrangement between the Government of 
Canada and a provincial or foreign government 


No disclosure was made pursuant to 8(2)(f) of the Act during this reporting period. 
Section 8(2)(g) — disclosure to a Member of Parliament 

No disclosure was made pursuant to 8(2)(g) of the Act during this reporting period. 
Section 8(2)(m) — disclosure in the public interest 


No disclosure was made pursuant to 8(2)(m) of the Act during this reporting period. 


Data-Matching and Data-Sharing Activities 


This Department is not active in any data-matching or data-sharing activities and, as such, there 
are none to report and describe for the period of 2007-08. 


Privacy Impact of any Legislative, Policy and Service Delivery Initiatives 
(Including Data-Matching and Data-Sharing Agreements) 


There is nothing to report on this item for the period of 2007-08. 


Improvements to Privacy Protection 
A Departmental Security Policy was introduced on October 1, 2006. The Security Policy is 


designed to protect employees; preserve the confidentiality, integrity, availability and value of 
Industry Canada’s departmental assets; and assure the continued delivery of services. 
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APPENDIX I — STATISTICAL REPORT ON THE 
PRIVACY ACT 


fi & Government Governement REPORT ON THE PRIVACY ACT 
of Canada du Canada 
RAPPORT CONCERNANT LA LOI SUR LA PROTECTION 
DES RENSEIGNEMENTS PERSONNELS 


Institution é INDUSTRY CANADA Reporting period Période visée par le rapport 
INDUSTRIE CANADA 4/1/2007 to/a 3/31/2008 


Exclusions cited Translations 
Exclusions citées V l | Traductions 


Requests under the Privacy Act 


Demandes en vertu de la Loi surla 
protection 


Received during reporting period 6 S. 0 Translations requested mal 0 
Regues pendant la période visée par le rapport Art. 69(1)(a) Traductions demandées | 
Outstanding from previous period _ 4 (b) 0 Translations | English to French 0 
En suspens depuis la pénode anténeure prepared De I'anglais au francais { 
s. Traductions | French to English : iF 
TOTAL 7 nch to Englis 
i Art. 70(1)(a) 0 préparées Du frangais a l'anglais 0 
= 
Completed during reporting period 5 (b) 0 
Traitées pendant la période visée par le 
Camied forward Method of access 
Reportées 2 (c) 0 Vi iH Méthode de consultation 
: se Copies given = ay 
Disposition of requests completed (d) 9) ‘ ap. 4 
aie Disposition a I'égard des demandes traitées Copies de l'original 2 £. 
- Examination 
All disclosed (e) 0 avait 0 
1. | Communication totale 2 Sane setone eles - | 
5 i Copies and examination 
Disclosed in part (f) 0 ra On| 
if 
2. Communication partielle 2 SESE CORED — i 
3 Nothing disclosed (excluded) 0 
; i Aucune communication (exclusion) “ ’ A 
pen. orrections and notation 
4 Nothing disclosed (exempt) ; 0 Completion time Corrections et mention 
; Aucune communication (exemption) Délai de traitement antes = 
T Corrections requested | 
5 Unable to process 6) 30 days or under 2 Corrections demandées 0 
( Traitement impossible 30 jours ou moins 2 - 5 —- ~—-— - 
: orrections made 
6 Abandoned by applicant 0 31 to 60 days 2 Corrections effectuées 
z Abandon de la demande De 31 460 jours = ae : eee + 
is a jotation attache | 
7 Transferred 4 61 to 120 days 0 Mention annexée | 0 | 
: Transmission De 61 4 120 jours = ra = eee eee ee 
121 days or over | 
TOTAL | 5) : 4 Costs 
L 121 jours ou plus : Po Colts 
Exemptions invoked Financial (all reasons) 
Exceptions invoquées Financiers (raisons) ($000) | 
a r od ol 
Ss Extensions Salary | 
Art. 18(2) 0 Prorogations des délais Traitement 1 8,41 0 ; 0 | 
q 30 days or under 31 days or over Administration (O and M) | 3 607 0 
H Art. 19(1)(a) 0 se : 30 jours ou moins 31 jours ou plus Administration (fonctionnement et maintien) | ’ 5 4 
Interference with operations 
b hides TOTAL 22,017.0 
fp) ie 0 Interruption des opérations 0 0 1 | 
(c) 0 Consultation 2 0 i a A 
d Translation (0) 0 Person year utilization (all reasons) 
(3) 0 Traduction Années-personnes utilisées (raisons) — - at 
Person year (decimal format) 
20 0 FOTAL 2 0 Années-personnes (nombre decimal) 0.30 
21 0 
. 22(1)(a) 1 
(b) 1 
(c) 0 
22(2) 0 
23(a) 0 
(b) 0 
. 24 ) 
st 
25 1 
26 2 
al 
el 1 
28 i 0 


Industry Canada 


ES 


ng 


Industrie Canada 


Treasury Board Secretariat is monitoring 
compliance with the Privacy Impact 
Assessment (PIA) Policy (which came into 
effect on May 2, 2002) through a variety of 
means. Institutions are therefore required 
to report the following information for the 
2007-2008 reporting period. 


Indicate the number of: 


Preliminary Privacy Impact Assessments 
initiated: 0 


Preliminary Privacy Impact Assessments 
completed: 0 


Privacy Impact Assessments 
initiated: 0 


Privacy Impact Assessments 
completed: 0 


Privacy Impact Assessments forwarded to 
the Office of the Privacy Commissioner 
(OPC): 0 


NB: Given the mandate of Industry 
Canada, PIAs are limited. 


If your institution did not undertake any of 
the activities noted above during the 
reporting period, this must be stated 


explicitly. 


Le Secrétariat du Conseil du Trésor surveille la 
conformité a la Politique sur l'Evaluation des 
facteurs relatifs a la vie privée (EF VP) (qui est 
entrée en vigueur le 2 mai 2002) par divers 
moyens. Les institutions sont donc tenues de 
déclarer les renseignements suivants pour la 
période de déclaration 2007-2008. 


Priére d’indiquer le nombre : 


d’évaluations préliminaires des facteurs relatifs 
alavie privée amorcées: _0 


d’évaluations préliminaires des facteurs relatifs 
a la vie privée achevées : 0 


d’évaluations des facteurs relatifs a la vie 
privée amorcées: _0 


d’évaluations des facteurs relatifs a la vie 
privée achevées : 0 


d’évaluations des facteurs relatifs a la vie 
privée acheminées au Commissariat a la 
protection de la vie privée 

(CPVP): 0 


NOTA : Le mandat d’Industrie Canada limite 
le nombre d’EF VP. 


Si votre institution n’a pas entrepris l’une ou 
autre des activités susmentionnées durant la 
période de rapport, cela doit étre mentionné de 


facon explicite. 


Industry Canada Industrie Canada 


No discrepancies to report . Aucune divergence a rapporter 


APPENDIX II — INDUSTRY CANADA DEPARTMENT 
STRUCTURE 


Deputy oe _Senlor Associate 
Minister Deputy Minister 


The Commissioner of Competition reports to 
the Deputy Minister for adrniristrative and 
financial purposes and reports to Parlament 
via the Minister in respect of independent 
jaw enforcement role. 


.ic.gc.ca/epic/site/ic | nsf/en/h_ 00020e.html 
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APPENDIX If — IPRA ORGANIZATIONAL 
STRUCTURE 


Manager* 
PM06 


Vacant Ss r a dvis or Ss | 2 Vacant Vacant 
Sr. ATIP Advisor > PN >h Sr. ATIP Advisor Sr. ATIP Advisor 
PMO05 oo : PMOS5 PMOS 


Vacant 
ATIP Advisor 


PM04 M03 ATIP Advisor 


‘MOS - 


* The manager’s position was temporarily filled via a departmental secondment process as part 
of a developmental initiative. 
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APPENDIX IV — DELEGATION OF AUTHORITY | 


ALL LAYS. SLL eee ._MVMm mm 


iS 


Industry Canada / Industrie Canada 


Access to Information Act and Privacy Act Delegation Order 


Arrété sur la délégation en vertu de la Loi sur l’accés a 
Vinformation et de la Loi sur protection des renseignements 
personnels 


The Minister of Industry Canada, pursuant 
to section 73 of the Access to Information 
Act and the Privacy Act, hereby designates 
‘the persons holding the positions set out in 
the schedule hereto, or the persons 


occupying on an acting basis those positions, 


to exercise the powers and functions of the 
Minister as the head of a government 
institution, under the section of the Acts set 
out in the schedule opposite each position. 
This Delegation Order supersedes all 
previous Delegation Orders. 


En vertu de l’article 73 de la Loi sur l’accés 
a l’information et la Loi sur la protection 
des renseignements personnels, le Ministre 
d’Industrie Canada délégue aux titulaires des 


‘postes mentionnés a 1’ annexe ci-aprés, ainsi 


qu’aux personnes occupant a titre 


_ intérimaire les-dits postes, les attributions 


dont il est, en-qualité.de responsable d’une 
institution fédérale, investie par les articles 
des lois mentionnées en regard de chaque 
poste. Le présent décret de délégation 
remplace et annule tout décret antérieur. 


Schedule / Annexe. 


Position / Poste 


Assistant Deputy Minister, 
Small Business and -  absolue 
Marketplace Services / 
Sous-ministre adjoint(e), 

Services axés sur le marché 

et.les petites entreprises 


Director, Information and 
_ Privacy Rights  absolue 
Administration (IPRA), 

Information Management 

Branch / Directeur (trice), 

Administration des droits a 

l’information et a la 

protection des 

renseignements personnels 

(ADIPRP), Gestion de 

information 


Access to Information Act and 
Regulations / Loi sur l’accés a 
lV’ information et réglements 


Full authority / Autorité 


Full authority / Autorité 


Privacy Act and Regulations / 
Loi sur la protection des 
renseignements personnels et 
réglements 


Full authority / Autorité 
absolue 


Full authority / Autorité 
absolue 


Deputy Director, IPRA- - - Full authority / Autorité Full authority / Autorité 
IMB / Directeur (trice) absolue absolue 
Adjoint(e), ADIPRP-DGI 


and 

Senior Advisor IPRA, IMB Sections / Articles: 7, 8(1), Sections / Articles : 8, 14, 
/ Conseiller (ére)  ~ Ohi else 14-15-16 15.51 95208 21 09 08024. 
_principal(e), ADIPRP - 18501920, 21;:22.23524-5- £023; 26521528, 69:45/0 
DGI 2592040 1(1), 6, 69 oe 

Dated, at the City of Ottawa 7 esr _ Daté, en la ville d’Ottawa 


this 43 day of oC 1a4% 2007 mi ce. 94 jour ddralre 2007 


THE HONOURABLE J IM PRENTICE 
MINISTER OF INDUSTRY CANADA 


{PHSTRE D’ INDUSTRIE CANADA ~ 
L’7HONORABLE JIM PRENTICE ~ 
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PREFACE AND PURPOSE 


The Privacy Act (Revised Statutes of Canada, Chapter A—-1, 1985) was proclaimed on 
July 1, 1983. 


The purpose of the Privacy Act “is to extend the present laws of Canada that protect 
the privacy of individuals with respect to personal information about themselves held 
by a government institution and to provide individuals with a right of access to that 
information” (Section 2 of the Act). The law also protects an individual’s privacy by 
preventing others from having access to that personal information and allows an 
individual specific rights concerning the collection and use of his/her information. 


Section 72 of the Privacy Act requires that the head of every government institution 
prepare for submission to Parliament an annual report on the administration of this Act 
within the institution during each financial year. 


This annual report describes how Industry Canada administered its responsibilities in 
the twenty-sixth year of operation of the Privacy Act. 


ABOUT THE ORGANIZATION 


Industry Canada’s Mandate 


Industry Canada's mandate is to help make Canadians more productive and 
competitive in the knowledge-based economy, thus improving the standard of living 
and quality of life in Canada. The Department's policies, programs and services help 
grow a dynamic and innovative economy that: 


e provides more and better-paying jobs for Canadians; 

* supports stronger business growth through continued improvements in 
productivity and innovation performance; 

e gives consumers, businesses and investors confidence that the marketplace is 
fair, efficient and competitive; 

e ensures a more sustainable economic, environmental and social future for 
Canadians. 


Industry Canada aims to help Canadians contribute to the knowledge economy and 
improve productivity and innovation performance through its three strategic 
objectives: 


1. a fair, efficient and competitive marketplace 
2. an innovative economy 
3. acompetitive industry and sustainable communities 


In order to foster growth and create high-quality, well-paying jobs, the Government of 
Canada has set as one of its core priorities the building of a 21st-century economy. 
Industry Canada will continue to work in support of this priority through its strategic 
objectives. For example, sound marketplace frameworks help establish a business 
environment that supports innovation, investment and entrepreneurial activity. 


Fostering innovation in science and technology helps ensure that discoveries and 
breakthroughs happen here in Canada, and that the social and economic benefits of 
these innovations contribute to Canadians' standard of living and quality of life. 


Promoting economic development in communities encourages an innovative, 
knowledge-based economy by supporting the development of skills, ideas and 
opportunities across the country. 


Taken together, the Department's strategic objectives support growth in employment, 
income, productivity and sustainable development in Canada. 


Context and Environment 


Industry Canada’s mandate is broad in nature, with responsibility for approximately 
50 distinct pieces of legislation and over 80 programs and initiatives involving all 
levels of government and multiple professional stakeholders. The Department works, 
inter alia, on matters related to industry and technology, trade and commerce, science, 
consumer affairs, corporations and corporate securities, competition and restraint of 
trade, weights and measures, bankruptcy and insolvency, patents and copyright, 
investment, and small business and tourism. 


In addition to its headquarters and other offices in the National Capital Region, the 
Department has five regional offices (Pacific, Prairie and Northern, Ontario, Quebec, 
and Atlantic), located in Vancouver, Edmonton, Toronto, Montréal and St. John's, 
respectively. The Department's regional presence also encompasses the Federal 
Economic Development Initiative of Northern Ontario (FedNor), 10 sub-offices and 
numerous district offices. Regional networks of staff (e.g., the Competition Bureau, 
Measurement Canada, the Office of the Superintendent of Bankruptcy Canada, and 
Spectrum Management and Telecommunications) enable the Department to deliver 
distinct services to clients across Canada. 


In addition, to help deliver on its strategic objectives, Industry Canada partners with 
other government departments to offer businesses and consumers a variety of 
programs and services. 


In the 2009 Budget, the Government announced the launch of several new initiatives 
and programs. A number of these were assigned to Industry Canada to implement and 
manage, in particular, the Knowledge Infrastructure Program, the Marquee Tourism 
Events program, the Recreational Infrastructure Canada Program, and the Southern 
and Eastern Ontario Development Programs. As a result, the Department realigned 
itself to better meet its increased responsibilities and respond to the Government’s 
priorities. To learn more, visit www.ic.gc.ca, canadabusiness.gc.ca and 
ConsumerInformation.ca. 


In 2008-09, by virtue of its mandate, Industry Canada played and continues to play an 
important role in implementing and advising on the Government of Canada's 
economic policy agenda, particularly in light of the ongoing economic slowdown in 
Canada and around the world. This has generated significant public interest in the 
activities of the Department. 


Departmental Structure 


Industry Canada employs approximately 5 800 employees across Canada and is 
broken into several sectors with distinct responsibilities to deliver its key priorities. 
Each sector is responsible for searching and retrieving documents responsive to 
official access requests received under the Access to Information Act and Privacy Act 
(ATIP). However, Information and Privacy Rights Administration (IPRA) is legally 
responsible for implementing and managing the ATIP program and services for 
Industry Canada, including decisions on the release or non-release of information 
pursuant to the legislation. 


The closely intertwined relationship between effective information management and 
compliance with the provisions of the ATIP legislation led to the decision in 2007 that 
IPRA would be best positioned within the Information Management Branch (IMB) of 
the Small Business and Marketplace Services Sector (SBMS). 


As one of the larger sectors, SBMS represents slightly more than 20 percent of the 
department’s employees. Its mission is to foster business and consumer confidence in 
the marketplace, as well as small business competitiveness, by championing and 
administering responsive legislation, policies, programs and services. 


Information Management Branch 


IMB has a multi-faceted responsibility for Information Management (IM), addressing 
the needs of several distinct clients. IMB services direct and support effective and 
efficient management of information in the organization, from planning and systems 
development, to disposal and/or long-term preservation. More specifically, the Branch 
provides departmental oversight and operational services related to record keeping, 
public access to departmental information, departmental access to commercial 
information and strategic direction related to elements of management practice and 
accountability. As a result, program managers can more readily meet their obligations 
under the Government’s Policy on Information Management, the Library and Archives 
Canada Act, the Access to Information Act, the Privacy Act and the Federal 
Accountability Act, and the Department can respect the intellectual property rights of 
commercial publishers. A key priority for IMB is the development and 
implementation of the IM Agenda for Industry Canada. 


Information and Privacy Rights Administration 


IPRA is responsible for the implementation and management of the Access to 
Information Act and Privacy Act programs and services for Industry Canada. IPRA 
has a complement of 15 employees including one Director, three managers, nine 
advisors and two support staff, all of whom are dedicated to processing access and 
privacy requests, along with other related functions. 


IPRA makes decisions on the disposition of access requests; promotes awareness of 
the legislation to ensure departmental responsiveness to the obligations imposed by 
law; monitors and advises on departmental compliance with the Acts, regulations, 
procedures and policies; and acts as the spokesperson for the Department when 
dealing with the Treasury Board Secretariat, the Information Commissioner, the 
Privacy Commissioner, and other government departments and agencies. IPRA is also 
responsible for conducting consultations with other federal departments with respect 
to access to information and privacy issues. 


Delegation of Authority 


In 2008-09, the Access to Information and Privacy (ATIP) Delegation Order was 
updated and approved by the new Minister. Full delegated authority is provided to the 
Assistant Deputy Minister of SBMS, the Director General of IMB, and the Director 
and managers of IPRA. For the daily ATIP operations, both the Director and 
managers of IPRA exercise full responsibility (see Appendix III). 


The Director of IPRA is responsible for the development, coordination and 
implementation of effective policies, guidelines and procedures to manage the 
department’s compliance with the Acts. The administration of the legislation in 
Industry Canada is also facilitated at the branch and regional office levels. Each 
organizational sector has a Liaison Officer (reporting to an Assistant Deputy Minister, 
Regional Executive Director, etc.) who coordinates activities and provides guidance 
on the administrative processes and procedures of the Acts. IPRA, which is located in 
Ottawa, responds to all formal requests submitted under the applicable Acts. 


2008—09 Highlights 


CHALLENGES and RESPONSES 
1. Human Resources 


Consistent with many ATIP offices, IPRA continued to face challenges in recruiting, 
developing and retaining staff in 2008-09. Of the 15 IPRA positions, only 12 were 
staffed for the majority of the reporting period. The 12 positions consisted of the 
Director, one manager (PM-06), three senior advisors (PM-05), one advisor at the 
PM-04 level and four at the PM-03 level, plus two support positions. A number of the 
employees were, for the most part, in development due to promotion, acting 
assignments and new arrivals. During part of the reporting period, a consultant was 
hired to assist with the workload. 


To address the continued challenges of recruitment and retention, IPRA implemented 
an ATIP - Professional Development Program (ATIP-PDP). IPRA also completed a 


review and restructuring of the unit to better meet the increasing business demands 
and expand on its policy advice and outreach services. 


Reorganization 


In 2008-09, IPRA had an independent review of its existing structure and resources. 
The new structure was approved in January 2009. The intent of the reorganization 
was to ensure that the appropriate level of resources were established to better meet 
the legal obligations of IPRA while allowing for increased career development 
opportunities that would be attractive to employees and new recruits, as well as 
improve retention. The new structure consists of three units. Two are operational and 
manage the daily activities in responding to formal requests received pursuant to the 
legislation. The third is responsible for policy and outreach (advice and training to 
departmental officials). 


IPRA was focused on implementing the new structure as described in Appendix II 
over the course of the last months of the reporting period and will continue with the 
implementation in the new fiscal year. 


ATIP — Professional Development Program 


Industry Canada’s ATIP — Professional Development Program (ATIP-PDP) has been 
in effect since 2005 for the purpose of developing employees from the PM-01 to the 
PM-04 level within the ATIP function. The program’s objective is to provide 
management with a tool to recruit, train and retain new resources interested in 
building a career in the ATIP field. The program provides for developing knowledge 
of the ATIP legislation, policy and directives, as well as other core competencies such 
as analytical thinking, decision-making and leadership that are needed now and in the 
future. Participants progressively acquire new competencies to meet both statutory 
and institutional needs, while maintaining and enhancing existing competencies to 
meet operational needs. Upon completion of the program, participants are fully 
functioning ATIP specialists (PM-04 or equivalent). 


In 2009, two IPRA employees graduated to the PM-04 level. One new candidate 
successfully completed the entrance exam and has been admitted to the program for a 
total of five participants. 


The program has been instrumental in facilitating the recruitment and retention of 
resources. It has also been effective in reducing the number of lengthy staffing 
processes and actions, and has been a positive influence on retention. 


2. Volume of work 


In 2008-09, the volume of privacy requests (11) represented only a fraction of the 
work managed by IPRA compared to requests received under the Access to 
Information Act. Typically, the Department processes 10 to 20 official privacy 
requests per year. In this reporting period, there was an increase in demand for advice 
and guidance related to policy and outreach issues. 


Departmental employees are made aware of their responsibilities regarding the proper 
management of personal information holdings on an ongoing basis. Responsible 
sectors are also required to consult with IPRA before collecting any personal 
information. IPRA must also be notified when personal information in a personal 
information bank is used or disclosed for a use consistent with the purpose for which 
the information was obtained or compiled, but was not identified in the statement of 
consistent uses published in Info Source. 


Most of the work of IPRA falls under the Access to Information Act. In 2008-09, the 
Department received 660 access requests and continued to process 118 outstanding 
cases from previous years for a total workload of 778 cases. In addition, the 
Department received one hundred and thirty-five consultation requests from more than 
32 other government departments and agencies. 


The number of ATI requests received almost doubled from the previous year (to 660 
from 342), while the scope, complexity and volume of the documents captured also 
continued to increase. Overall, the Department completed a total of 653 requests (526 
access and 127 consultations) as compared to 431 the previous year. The volume of 
documents requested also significantly increased to more than 689 000 pages as 
compared to 183 000 pages in 2007-08. 


The Department has launched a number of initiatives to help manage the increasing 
volume of work required to meet its ATIP obligations. 


Case Document Management 


Because timely, complete and accurate document retrieval and processing is the 
foundation of the ATIP legislation, IPRA will continue to promote IM/IT solutions 
that will permit better document management outside of its own office,. For its part, 
IPRA continues to work towards improving its case management processes and has 
purchased a new electronic ATIP System to be implemented over the course of the 
next fiscal year. This new tool will improve monitoring and tracking, as well as 
address the increased reporting requirements, allowing IPRA to manage its day-to-day 
workflow more effectively. 


Working Partnerships 


Over the past few years, in an effort to mitigate risks and ultimately reduce workload, 
IPRA has established a number of working partnerships with core administrative 
functional areas, such as the Chief Informatics Office (CIO), the Comptrollership and 
Administration Sector (CAS), the Human Resources Branch (HRB), the Audit and 
Evaluation Branch (AEB), Central Integrated Records Services (CIRS), and the 
Corporate and Portfolio Office (CPO). These partnerships have included the following 
activities: 


Comptrollership and Administration Sector (CAS) 


The recently amended Security Policy refers to the ATIP legislation. 
Consequently, IPRA has an informal working relationship with Security 
Services reviewing departmental policies and directives, and providing advice. 
As part of the government’s policy on the mandatory publication of travel and 
hospitality expenses for selected government officials (proactive disclosure), 
IPRA reviews the information regarding travel and hospitality expenses before 
it is posted publicly on the departmental website. The review ensures that no 
personal information is included in the information. In 2008-09, IPRA 
completed a review of more than 1100 items. 


Chief Informatics Office (CIO) 


The CIO, in building its governance framework for IT projects, has included 
Threat Risk Assessments (TRAs), Preliminary Privacy Impact Assessments 
(PPIAs) and Privacy Impact Assessments (PIAs) among the core documents. 
IPRA is responsible for reviewing and approving the PPIAs and PIAs, and for 
providing guidance to departmental officials regarding their content. In 2008- 
09, IPRA provided advice on, and reviewed and approved, 10 PPIAs 
concerning updates to existing electronic tools. 


Corporate Integrated Records Services (CIRS) 


IPRA continues to work closely with CIRS on many fronts, in particular, 
providing guidance and advice on issues related to retention/disposal, 
ownership and control of documents in keeping with legal and accountability 
requirements. 


Human Resources Branch 


IPRA provides general advice and guidance to HRB concerning privacy issues 
related to employees. Other services include completing reviews of reports 
such as harassment/grievance/disciplinary to ensure the balance of privacy and 
right of access. 


Education and Training Activities 


Enhanced awareness and knowledge of ATIP obligations of departmental officials 


improves compliance with legal obligations, turnaround times and the quality of 
responses. 


In 2008-09, IPRA prepared and delivered 25 ATIP training sessions (including 6 to 
regional officials) and reached more than 500 employees. This is a 92 percent increase 
from the previous year. Upon request, sessions may be tailored to suit the needs of a 
specific group. In addition to these formal sessions, an intranet site is used to create 
awareness and disseminate information to employees. 


ATIP Policies, Procedures and Business Practices 


Industry Canada ensures that Treasury Board policies are implemented, either through 
internal departmental policies and/or directives and guidelines. IPRA has also 
implemented and documented various business practices to increase performance and 


efficiency in managing the ATIP programs and services, including the following 
highlights: 


Privacy Impact Assessments and Preliminary Privacy Impact Assessments 


There were no PIAs initiated or completed during this reporting period and, therefore, 
none were forwarded to the Office of the Privacy Commissioner. However, ten PPIAs 
were initiated and completed during the period. 


IPRA reviewed and approved ten PPIAs as part of its working partnership with the 

CIO. The PPIAs consisted, for the most part, of updates to existing electronic tools/ 
applications related to existing programs and initiatives, and based upon legislative 

requirements. It was also determined that the PPIAs described enhanced tools with 

little change to content and that there was no change to the purpose, collection, use, 
disclosure and retention of personal information. 


In addition, it was concluded that the content was related to commercial/business 
information required by the department to deliver on its mandate. Personal 
information in these cases consisted of a name and contact information, which was a 
business address required for communication purposes. 


Disclosures Made Pursuant to Paragraph 8(2) — Permissible Disclosures 


e Section 8(2)(e) — disclosure made to an investigative body (as described in the 
Regulations) 
No disclosure was made during this reporting period. 


e Section 8(2)(f) — disclosure under agreement or arrangement between the 
Government of Canada and a provincial or foreign government 
No disclosure was made during this reporting period. 


e Section 8(2)(g) — disclosure to a Member of Parliament 
No disclosure was made during this reporting period. 


e Section 8(2)(m) — disclosure in the public interest 
No disclosure was made during this reporting period. 


Data-Matching and Data-Sharing Activities 


This Department is not active in any data-matching or data-sharing activities and as a 
result, there are no activities of this nature to report for 2008-09. 


Privacy Impact of any Legislative, Policy and Service Delivery Initiatives (Including 
Data-Matching and Data-Sharing Agreements) 


There is no information to report with regard to this item for 2008-09. 
Improvements to Privacy Protection 


A Departmental Security Policy was introduced on October 1, 2006. The Security 
Policy is designed to protect employees, preserve the confidentiality, integrity, 
availability and value of Industry Canada’s departmental assets, and assure the 
continued delivery of services. 


Assisting Applicants 


Over the years, IPRA has implemented and established various approaches to better 
assist and respond to applicants. In 2008-09, IPRA began documenting the following 
established business practices to assist applicants: 


e Regular communication is established with applicants to clarify and narrow 
requests, provide updates and explain the privacy rights pursuant to the Act; 

e Accurate, timely and complete responses are completed in good faith. 
Alternate solutions may be suggested, such as informal processes, publicly 
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accessible information and, if applicable, referrals to other organizations 
involved; 

e Records are provided in the format requested. Since 2001, IPRA has been 
providing processed documents on CD-ROM in PDF format at no cost to the 
applicant and if the material is less than 50 pages, a hard copy is provided; 

e Other practices involve facilitating discussions and/or meetings with program 
officials and providing interim responses when possible. 


Informal Practices 


Consistent with the principle that the Act is intended to complement, rather than 
replace, existing procedures for access to government information, informal requests 
may be addressed directly to branches within the Department. IPRA routinely directs 
requesters to the relevant sectors. 


Publicly Accessible Information, Website and Enquiry Points 


The Department is broad and diverse in nature and manages various distinct laws that 
legally allow for publicly accessible information. Industry Canada has a 
comprehensive website and provides a number of enquiry points where the public may 
submit a query and obtain information on an informal basis, specifically: 


e ic.gc.ca (formerly “Strategis”) 

® Canada Business 

e Canadian Consumer Information Gateway 
* Canadian Intellectual Property Office 

° Corporations Canada 


° Office of the Superintendent of Bankruptcy 
ATIP Website 


IPRA also has its own Internet site (www.ic.gc.ca/cmb/welcomeic.nsf/ICPages/ 

_AccessToInformation). The site contains general information, points of contacts and 
links to other key departments and agencies, including the ATIP Offices for the 
Industry Portfolio. 


Info Source 


IPRA is responsible for providing a full accounting of the department’s information 
holdings to the Treasury Board Secretariat and it ensures that updates are provided on 
a timely basis for inclusion in Info Source. Info Source may be obtained through 
public and academic libraries, or may be viewed online at 


www.infosource.gc.ca/index-eng.asp. 


Reading Rooms 


A reading room is available at Industry Canada headquarters and in all regional offices 
as required. Current departmental manuals are available for review by the public upon 
request. They may also be provided electronically. 


PRIVACY — TRENDS AND STATISTICS 


Significant Trends 


As stated earlier, Industry Canada’s mandate is focused on Canadian businesses. The 
department’s programs and initiatives assist in building a more productive, 
competitive and knowledge-based economy for Canada. As a result, there are few 
privacy requests and issues. 


Since there were few official requests received during the reporting period, no 
significant trend was noted. The few privacy requests received most frequently 
involved issues related to staffing exercises (such as rating guides and screening 


processes), performance, personal comments and bankruptcy files held by the Office 
of the Superintendent of Bankruptcy. 


Statistical Report — Interpretation and Explanation 


A summarized statistical report on Privacy Act requests processed from April 1, 2008 
to March 31, 2009, is found in Appendix I. An explanation and interpretation of 
information contained in the appendix follows. 

I. Requests Received under the Privacy Act 

Of the 11 requests processed during this reporting period, two were outstanding from 
previous years and nine requests were new. Three requests were carried forward into 
the new fiscal year. A total of eight requests were completed and 3,500 pages 
reviewed. 

II. Disposition of Requests Completed 

Of the 11 active requests, eight requests were completed during the 2008-09 reporting 
period and three requests remained to be processed as of March 31, 2009. The 
completed requests fall into the following categories: 

All Disclosed — In one case, the requester was granted full access. 

Disclosed in Part — In two cases, the requesters were granted partial access. 

Unable to Process — two requests could not be processed. 


Abandoned by Applicant — three requests were abandoned by the applicant. 


Transferred — No requests were transferred. 
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III. Exemptions Invoked 


As noted in Appendix I, the Department invoked exempting provisions pursuant to 
sections 26 and 27 of the Privacy Act. 


IV. Exclusions Cited 
The Department did not invoke any exclusions pursuant to the Act. 
V. and VI. Completion Time and Extensions 


The Department processed all eight cases within legislated time periods as noted in 
Appendix I. 


VII. Translations 

No translations were undertaken in dealing with these requests. 

VIII. Method of Access 

In response to three requests, copies of the records were provided to the applicants by 
hard copy or by transferring the records onto CDs. There were no requests for on-site 
examination. 

IX. Corrections and Notation 

No requests for corrections or notation were received. 

X. Costs 

Total salary costs associated with administering Privacy Act activities were estimated 
at $11 269 for this reporting period. Non-salary costs were estimated at $1 741 fora 
total cost of $13 010. The associated human resources (including both IPRA and 


departmental officials) required to fulfill this function were estimated at less than one 
full-time employee. 


Complaints, Investigations and Appeals 
Applicants have the right of complaint pursuant to the Act and may exercise this right 
at any time during the processing of their request. The Department received two new 


complaints for this reporting period. Both complaints received were related to time 


delays in processing the requests. One complaint was found to have merit and the 
other is still under investigation. 


There was one appeal filed with the Federal Court of Canada during the reporting 
period. The Court dismissed the case. 

Changes Resulting from Issues Raised by Officers of Parliament 
Office of the Privacy Commissioner of Canada 

Other than the complaints noted above, there is nothing to report for 2008-09. 
Office of the Auditor General of Canada 


There is nothing to report for 2008-09. 
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APPENDIX I — STATISTICAL REPORT ON THE 
PRIVACY ACT 


fi se Government Governement REPORT ON THE PRIVACY ACT 
4 of Canada du Canada 
RAPPORT CONCERNANT LALO! SUR LA PROTECTION 
DES RENSEIGNEMENTS PERSONNELS 
Institution INDUSTRY CANADA Reporting period Période visée par le rapport 
INDUSTRIE CANADA / 


4/1/2008 to/a 3/31/2009 


Requests under the Privacy Act 


eat en vertu de la Loi sur la ; IV Exclusions cited Translations 
protection i Exclusions citées Traductions 
Received during reporting period 9 S. Translations requested 
Regues pendant la période visée par le rapport Art. 69(1)(a) Traductions demandées 0 
Outstanding from previous period a 9) (b) Translations | English to French 
En suspens depuis la période antérieure prepared De fanglais au francais 0 
Ser Traducti i 
TOTAL 11 faductions | French to English 
Art. 70(1)(a) préparées Du frangais a l'anglais 0 


Sompleted during reporting period 
[raitées pendant la période visée par le 


(oe) 


(b) 


Sarried forward 
Reportées 


ow 


(c) 


Disposition of requests completed 
Disposition a l'égard des demandes traitées 


All disclosed 
Communication totale 


Disclosed in part 
Communication partielle 


Nothing disclosed (excluded) 
Aucune communication (exclusion) 


Nothing disclosed (exempt) 
Aucune communication (exemption) 


Unable to process 
Traitement impossible 


Method of access 
Méthode de consultation 


Copies given 
Copies de original 3 


SHS) HS) ey |) jl es 


Examination 

Uo) Examen de original 0 
Copies and examination 

(f) 0 


Copies et examen 


Completion time 
Délai de traitement 


30 days or under 7] 
30 jours ou moins 


Corrections and notation 
Corrections et mention 


Corrections requested 0 
Corrections demandées 


Abandoned by applicant 
Abandon de la demande 


31 to 60 days 4 
De 31 4 60 jours 


Corrections made 0 
Corrections effectuées 


COE OE ICONS RO EOL lenox 


Notation attached 0 
7 WS tes 61 to 120 days 0 Mention annexée 
: Transmission -| De 61 a 120 jours 
[TOTAL ag ae 0 Costs 
jours ou plus Coats 
Exemptions invoked Financial (all reasons) 
Exceptions invoquées ; Financiers (raisons) ($000) 
Extensions Salary’ ; 
t. 18(2) Prorogations des délais Traitement 11,269.0 
a 30 days or under 31 days or over Administration (O and M) 4 741 0 
t. 19(1)(a) 30 jours ou moins | 31 jours ou plus Administration (fonctionnement et maintien) ’ : 
b’ Interference with operations TOTAL 
" Interruption des opérations 0 0 : 1 3,01 0.0 
(c) Consultation 1 0 
Translation ) 0 Person year utilization (all reasons) 
) Traduction Années-personnes utilisées (raisons) 
Person year (decimal format) 
| 20 1 0 Années-personnes (nombre décimal) 0.20 
mat 
. 22(1)(a) 
(b) 
(c) 
. 22(2) 
. 23(a) . 
(b) 
24 
25 
26 
27 


Appendix B 


Annexe B 


Treasury Board Secretariat is monitoring 
compliance with the Privacy Impact 
Assessment (PIA) Policy (which came into 
effect on May 2, 2002) through a variety of 
means. Institutions are therefore required 
to report the following information for this 
reporting period. 


Indicate the number of: 


Preliminary Privacy Impact Assessments 
initiated: 10 


Preliminary Privacy Impact Assessments 
completed: 10 


Privacy Impact Assessments 
initiated: _—O 


Privacy Impact Assessments 
completed: _O 


Privacy Impact Assessments forwarded to the 
Office of the Privacy Commissioner (OPC): 
0 


If your institution did not undertake any of the 
activities noted above during the reporting 


period, this must be stated explicitly. 


Le Secrétariat du Conseil du Trésor surveille la 
conformité a la Politique sur l'Evaluation des 
facteurs relatifs a la vie privée (EF VP) (qui est 
entrée en vigueur le 2 mai 2002) par divers 
moyens. Les institutions sont donc tenues de 
déclarer les renseignements suivants pour cette 
période de déclaration. 


Veuillez indiquer le nombre : 


d’évaluations préliminaires des facteurs relatifs ala 
vie privée amorcées : 10 


d’évaluations préliminaires des facteurs relatifs a la 
vie privée achevées : 10 é 


d’évaluations des facteurs relatifs a la vie privée 
amorcées : 


d’évaluations des facteurs relatifs a la vie privée 
achevées : 0 


d’évaluations des facteurs relatifs a la vie privée 
acheminées au Commissariat a la protection de la 
vie privée (CPVP) : 0) 


Si votre institution n’a pas entrepris l’une ou I'autre 
des activites susmentionnées durant la période de 


rapport, cela doit étre mentionné de facon explicite. 


Appendix C 


No discrepancies to report 


Aucune divergence a rapporter 


APPENDIX II — IPRA ORGANIZATIONAL 
STRUCTURE 


IPRA Organization / Organization de l’ ADIPRP 
March 2009 / Mars 2009 


K. Eadie 


Director / Directrice 
EX01 


S. Gagné 


S. Tremblay 
ATIP Client-Service Officer / 
Agente de service a la clientéle 
PM02 


ATIP Client-Service Officer / 
Agente de service a la clientéle 
PMO1 


L. Asselin 
Manager / 
Gestionnaire 
PMO6 


Vacant Vacant 
Manager / Manager / 
Gestionnaire Gestionnaire 
PMO6 PMO06 


M. Teske Vacant D. Bourgeault L. Lebel Vacant 

A/Sr. ATIP Advisor / Sr. ATIP Advisor / Sr. ATIP Advisor / Sr. ATIP Advisor / Sr. ATIP Advisor / 

Conseillére principale onseiller principale Conseiller principal Conseillére principale Conseiller principal 
int. d’'AIPRP d'AIPRP d'‘AIPRP d'AIPRP 


PMO05S PMO05 PMO05S PM05 PMO05 


R. Diaz-Rivas 
ATIP Advisor / 
Conseiller d'AIPRP 
PM03 


Vacant 
ATIP Advisor / 


Conseiller d'AIPRP 
PM04 


C. Walton 
ATIP Advisor / 
Conseillére d'‘AIPRP 
PMO3 


Vacant 
ATIP Advisor / 


Conseiller d’AIPRP 
PM04 


Z. Karim T. Wagdin 


ATIP Advisor / 
Conseillére d‘AIPRP 
PM03 


R. Roy 
ATIP Advisor / 
Conseillére d'AIPRP 
PMO03 


ATIP Advisor / 
Conseillére d'AIPRP 
PM04 


Vacant 
ATIP Advisor / 
Conseiller d‘AIPRP 
PM04 


APPENDIX III — DELEGATION OF AUTHORITY 


Industry Canada / Industrie Canada 


Access to Information Act and Privacy Act Delegation Order 


Arrété sur la délégation en vertu de la Loi sur l’accés a 
Vinformation et de la Loi sur protection des renseignernents 
personnels 


The Minister of Industry Canada, pursuant 
to section 73 of the Access to Information 
Act and the Privacy Act, hereby designates 
the persons holding the positions set out in 
the schedule hereto, or the persons 
occupying on an acting basis those positions, 
to exercise the powers and functions of the 
Minister as the head of a government 
institution, under the section of the Acts set 
out in the schedule opposite each position. 
This Delegation Order supersedes all 
previous Delegation Orders. 


En vertu de I’article 73 de la Loi sur l’accés 
a l'information et la Loi sur la protection 
des renseignements personnels, le Ministre 
d’Industrie Canada délégue aux titulaires des 
postes mentionnés a 1’ annexe ci-aprés, ainsi 
qu’aux personnes occupant 4 titre 
intérimaire les-dits postes, les attributions 
dont il est, en qualité de responsable d’une 
institution fédérale, investie par les articles 
des lois mentionnées en regard de chaque 
poste. Le présent décret de délégation 
remplace et annule tout décret antérieur. 


Schedule / Annexe 


Position / Poste 


Assistant Deputy Minister, 
Small Business and absolue 
Marketplace Services / 

Sous-ministre adjoint(e), 

Services axés sur le marché 

et les petites entreprises 


Director General, 
Information Management 
Branch (IMB) / Directeur absolue 
(trice) général, Gestion de 

l’ information (DGI) 


Access to Information Act and 
Regulations / Loi sur l’accés a 
information et réglements 


Full authority / Autorité 


Full authority / Autorité 


Privacy Act and Regulations / 
Loi sur la protection des 
renseignements personnels et 
réglements 


Full authority / Autorité 
absolue 


Full authority / Autorité 
absolue 


Director, Information and Full authority / Autorité Full authority / Autorité 
Privacy Rights absolue absolue 
Administration (IPRA), 

Information Management 

Branch (IMB)/ Directeur 

(trice), Administration des 

droits a |’information et a la 

protection des 

renseignements personnels 

(ADIPRP), Gestion de 

l’information (DGGI) 


Manager, IPRA-IMB / Full authority / Autorité Full authority / Autorité 
Gestionnaire, ADIPRP- absolue _ absolue 

DGGI . 

and 

Senior Advisor IPRA, IMB Sections / Articles: 7, 8(1), Sections / Articles : 8(1), 
/ Conseiller (ére) 9, 11(4)(5), 13, 14, 15, 16, 14, 1531920521 22223. 
principal(e), ADIPRP - a weve ke yA ae separ 2 A429, 20521528, 095 10 
DGI 24, 25, 26, 27(1), 68, 69 

Dated, at the City of Ottawa Daté, en la ville d’Ottawa 

this @* day of July , 2008 2009 ce “("" jour de juilel 2008 2009 


THE HONOURABLE MINISTER CLEMENT 
MINISTER/OF/INDUSTRY CANAD 


MINISTRE D’ INDUSTRIE CANADA 
L’> HONORABLE MINISTRE CLEMENT 
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PREFACE AND PURPOSE 


The Privacy Act (Revised Statutes of Canada, Chapter A—-1, 1985) was proclaimed on 
July 1, 1983. 


The purpose of the Privacy Act “is to extend the present laws of Canada that protect 
the privacy of individuals with respect to personal information about themselves held 
by a government institution and to provide individuals with a right of access to that 
information” (Section 2 of the Act). The law also protects an individual’s privacy by 
preventing others from having access to that personal information and allows an 
individual specific rights concerning the collection and use of his/her information. 


Section 72 of the Privacy Act requires that the head of every government institution 
prepare for submission to Parliament an annual report on the administration of this Act 
within the institution during each financial year. 


This annual report describes how Industry Canada administered its responsibilities in 
the twenty-seventh year of operation of the Privacy Act. 


ABOUT THE ORGANIZATION. 


Industry Canada’s mission is to foster a growing, competitive, knowledge-based 
Canadian economy. The Department works with Canadians throughout the economy, 
and in all parts of the country, to improve conditions for investment, improve 
Canada’s innovation performance, increase Canada’s share of global trade, and build 
an efficient and competitive marketplace. 


Industry Canada’s mandate is to help make Canadian industry more productive and 
competitive in the global economy, thus improving the economic and social well- 
being of Canadians. The many and varied activities Industry Canada carries out to 
deliver on its mandate are organized around three interdependent and mutually 
reinforcing strategic outcomes, each linked to a separate key strategy. The key 
strategies are shown in the illustration below. 


Prosp 


petitiveness 


e The Canadian marketplace is efficient and competitive 
Advancing the marketplace 


Industry Canada fosters competitiveness by developing and administering 
economic framework policies that promote competition and innovation; support 
investment and entrepreneurial activity; and instill consumer, investor and 
business confidence. 


¢ Science and technology, knowledge, and innovation are effective drivers of a 
strong Canadian economy 


Fostering the knowledge-based economy 


Industry Canada invests in science and technology to generate knowledge and 
equip Canadians with the skills and training they need to compete and prosper in 
the global, knowledge-based economy, These investments help ensure that 
discoveries and breakthroughs take place here in Canada and that Canadians 
realize the social and economic benefits. 


* Competitive businesses are drivers of sustainable wealth creation 
Supporting business 


Industry Canada encourages business innovation and productivity because 
businesses generate jobs and wealth creation. Promoting economic development in 
communities encourages the development of skills, ideas and opportunities across 
the country. 


Context and Environment 


Industry Canada works on a broad range of matters related to industry and technology, 
trade and commerce, science, consumer affairs, corporations and corporate securities, 
competition and restraint of trade, weights and measures, bankruptcy and insolvency, 
patents and copyright, investment, small business, and tourism. 


Given the role the Department plays in promoting economic development and 
regulating the marketplace, there is significant public interest in the information 
collected and produced. Key areas of interest in 2009-10 included the auto industry, 
tourism, small business, as well as various statutes, namely the Competition Act, the 
Canada Investment Act and the Copyright Act. 


In 2009-10 Industry Canada played an important role in implementing the 
Government of Canada's Economic Action Plan (EAP), introduced in January 2009 as 
part of Budget 2009. The EAP focuses on ensuring Canada makes a quick recovery 
from the global recession, sustains long-term economic growth at home and plays a 
leading role in the coordinated international effort to produce a worldwide economic 
recovery. 


The high profile EAP initiatives implemented by Industry Canada included 
distribution of stimulus funding to traditional industries, including the manufacturing 
sector, and providing assistance to the Canadian automotive sector to support the 


orderly restructuring of this critical industry, with the goal of maintaining Canada’s 
share of North American production, 


In addition, through the Knowledge Infrastructure Program, the Department is 
providing $2 billion over twe years te create jobs in communities across Canada by 
revitalizing research and training facilities at Canadian universities and colleges. 
These initiatives have generated significant public interest in the activities of the 
Department. 


Given Industry Canada’s mandate and mission, it is understandable that there is little 
activity conducted under the Privaey Act. 


Departmental Structure 


The Department employs $800 professionals across the country, including economists, 
engineers, scientists, commerce officers, inspectors, metrelogists, statisticians, 
accountants and lawyers, supported by others carrying out corporate functions such as 
human resources and financial management, communications, and information 
management/information technology support. 


ib Department is organized into 11 sectors and four corporate branches (see 

ww.ic.g¢.ca). In addition to its headquarters and other offices in Ottawa, the 
Deine has five regional offices (Pacific, Prairie and Northern, Ontario, Quebec, 
and Atlantic), located in Vancouver, Edmonton, Toronto, Montréal and St. John's, 
respectively, The Department's regional presence also encompasses the Federal 
Economic Development Initiative of Northern Ontario (FedNor) and the Federal 
Economic Development Agency for Southern Ontario (FedDev Ontario), 


Each of these sectors and branches are responsible for searching and retrieving 
documents responsive to official access requests received under the Access fo 
Information Act and Privacy Act (ATIP). However, Information and Privacy Rights 
Administration (IPRA) is legally responsible for implementing and managing the 
ATIP program and services for Industry Canada, including decisions on the release or 
non-release of information pursuant to the legislation. 


Given that the effective management of information is critical to the administration of 
the Access te Information Act and Privacy Act, IPRA resides with the Information 
Management Branch (IMB), a branch in Small Business and Marketplace Services 
Sector (SBMS), IMB directs and supports an Information Management (IM) program 
to ensure the effective and efficient management of information within Industry 
Canada. The IM program provides strategic direction and services related to 


recordkeeping, public access to departmental information, departmental access to 
commercially published information and information management policy, 
accountability, governance, planning and reporting. As a result, departmental program 
managers can more readily deliver their programs and services, as well as meet their 
obligations under the Government’s Policy on Information Management, the Library 
and Archives Canada Act, the Access to Information Act, the Privacy Aet and the 
Federal Accountability Act, Further, it ensures that the Department respects the 
intellectual property rights of commercial publishers. 


IMB provides services to the Department from four Directorates: Corporate Integrated 
Records Services (CIRS), the Library and Knowledge Centre (LKC), IM Policy, 
Planning and Innovation (IMPPI), and Information and Privacy Rights Administration 
(IPRA), 


IPRA is responsible for the implementation and management of the Access to 
Information Act and Privaey Act programs and services for Industry Canada. 
Specifically, IPRA makes decisions on the disposition of access requests; promotes 
awareness of the legislation to ensure departmental responsiveness to the obligations 
imposed by law; monitors and advises on departmental compliance with the Acts, 
regulations, procedures and policies; and acts as the spokesperson for the Department 
when dealing with the Treasury Board Secretariat, the Information Commissioner, the 
Privacy Commissioner, and other government departments and agencies, IPRA is also 
responsible for conducting consultations with other federal departments with respect 
to access to information and privacy issues. 


IPRA has a complement of 15 employees including one Director, three managers, 
nine advisors and two support staff, all of whom are dedicated to processing access 
and privacy requests, along with related functions. 


The current Access to Information and Privacy (ATIP) Delegation Order was 
approved by the Minister in July 2009, and provides full-delegated authority to the 
Assistant Deputy Minister of SBMS, the Director General of IMB, the Director and 
the managers of IPRA. The designation of the Director General position is for 
purposes of providing strategic support and advice to the executive management of 
the Department concerning ATIP issues, if and when required. For all daily ATIP 
activities and operations, the Director and the managers of IPRA exercise full 
responsibility (see Appendix III). 


The Director of IPRA is responsible for the development, coordination and 
implementation of effective policies, guidelines and procedures to manage the 
Department’s compliance with the Acts. The administration of the legislation in 
Industry Canada is managed by IPRA, but is also facilitated at the Sector, branch and 
regional office levels. Each sector and corporate branch has an ATIP Liaison Officer 
(reporting to an Assistant Deputy Minister, Regional Executive Director, etc.) who 
coordinates activities and provides guidance on the administrative processes and 
procedures of the Acts, IPRA, which is located in Ottawa, responds to all formal 
requests submitted under the applicable Acts. 


2009-10 Highlights 


In 2009-10, the Department saw an increase in the volume of privacy requests 
received under the Privacy Act as compared te the previous year. In total 32 formal 
requests were received as compared to nine in 2008-09, however, this is but a fraction 
of the overall work managed by IPRA. 


More frequently privacy activities will involve awareness, training and policy issues 
concerning defining and managing personal information within Industry Canada. 
Departmental officials will regularly consult with IPRA before collecting personal 
information; review rules related to consistent use and/or disclosure in accordance 
with the purpose for which the information was obtained or compiled and seek advice 
concerning other privacy issues. 


Although IPRA did face a number of challenges in 2009-10, it also achieved a number 
of accomplishments as deseribed in the 2009-10 Annual Report on the Access to 
Information Act, However, one constant challenge remains and that is the resourcing 
issue to support the ATIP program and services. 


e Resources —- Human and Financial 


In 2009-10, IPRA continued to face challenges in managing and retaining staff to 
perform its daily operations and meet its legal compliance requirements. A new 
organizational structure was implemented to better meet the increasing business 
demands and to allow IPRA to expand on policy advice and outreach services; 
however, there was no change to the overall resourcing. IPRA now consists of three 
teams (see Appendix II), with two teams responsible for the daily operations and one 
for policy and outreach. IPRA continues to operate within an allocation of 15 full- 
time employees and an operating budget of approximately $1.2 million. 


In order to be more competitive in a high-demand market, and to be more attractive as 
an employer, IPRA provides career progression opportunities with the use of the 
ATIP Professional Development Program (ATIP-PDP). IPRA has also been 


innovative, using inter-departmental staffing processes where possible and other 
recruitment/staffing tools, all of which have positively influenced retention and 
succession planning. 


e Resources and Warkload 


Of the 15 IPRA positions, 13 were staffed for the majority of the reporting period. 
The 13 positions consisted of the Director, three managers (PM-06), three senior 
advisors (PM-05), three advisors at the PM-04 level and one at the PM-03 level, plus 
two support positions (PM-02 and AS-01). During part of the reporting period, a 
consultant was hired to assist with the workload, 


In 2009-10, the policy and outreach unit, consisting of two people (PM-06 and PM-05), 
was responsible for maintaining the various partnerships with ether functional areas, 
overseeing various projects/initiatives (e.g., ATIP case management tool, IM 
initiatives, Info Source Renewal, etc.), and delivering ATIP advice/guidance including 
providing training and awareness sessions across the Department. They completed the 
following activities: 


ACTIVITY TOTAL 
(Questions/Reviews 
/Emails/ Reports, 


Review of audit and aeraiise reports prior to being publicly 
posted on the departmental website. 


Review of proactive disclosures prior to being publicly posted 
on the departmental website _ 4 

Prepare and deliver ATIP training/awareness sessions to 
departmental officials 


Review and approval of Preliminary Privacy Impact 
Assessments/Privacy Impact Assessments 


OTHER 
_Update to IPRA public website Of see 


Input to MAF and DPR (ATIP user fees) 
Managing Info Source updates and providing submission to 
TBS 


Review and update business prac | 
Participate in various initiatives across IC (e.g., enterprise wiki, 
IM initiatives (IM outcomes, Business-Based Classification 

System, etc.) 


procedures for IPRA TX 


practices and pi 


IPRA ensures that Treasury Board ATIP policies are respected and implemented in the 
form of internal guidelines, procedures, and business practices. This has allowed IPRA 
to increase performance and efficiency in managing the ATIP programs and services 
for the Department. Over the years, IPRA has developed and implemented a number 
of initiatives to promote privacy awareness and improve compliance with legislative 
requirements. These have included the following: 


Assisting Applicants 


Over the years, IPRA has implemented various approaches to better assist and respond 
to applicants. Established practices include the following: 


The applicant’s identity is not considered during the processing of a request, 
nor is it revealed to departmental officials, unless there is a need to know to 
retrieve information and/or if consent is provided by the applicant; 

Regular communication is established with applicants to clarify and narrow 
requests, provide updates and explain the privacy process and rights pursuant 
to the Act; 

Accurate, timely and complete responses are compiled in good faith. Alternate 
solutions may be suggested, such as previously released, or publicly accessible 
information, and, if applicable, referrals to other organizations involved; 
Records are provided in the format requested. Since 2001, IPRA has been 
providing processed documents on CD-ROM in PDF format at no cost to the 
applicant. At times, releases of data extracts are provided in Excel, Lotus 
and/or ASCII format and if the material is less than 50 pages, a hard copy is 
provided; 

Other practices involve facilitating discussions and/or meetings with program 
officials, providing interim responses when possible and limiting fees charged 
to the applicant where possible. 


Partnerships 


Over the past few years, in an effort to mitigate risks and ultimately reduce workload, 
IPRA has established a number ef working partnerships with core administrative 
functional areas. These partnerships have continued to flourish, and included the 
following: 


Comptrollership and Administration Sector (CAS) 
e As part of the government's policy on the mandatory publication of travel and 
hospitality expenses for selected government officials (proactive disclosure), 
IPRA reviews the information regarding travel and hospitality expenses before 
it is pasted publicly on the departmental website. The review ensures that no 
personal information is included in the information. 


Chief Informatics Office (CIO) 

e The governance framework for IT projects includes Threat and Risk 
Assessments, Preliminary Privacy Impact Assessments (PPIAs) and Privacy 
Impact Assessments (PIAs) among the core documents. IPRA is responsible 
for reviewing and approving the PPIAs and PIAs, and for providing advice to 
departmental officials regarding their content. 


Human Resources Branch (HRB) 

e Providing general advice and guidance concerning privacy issues related to 
employees; reviewing reports such as harassment/grievance/disciplinary to 
ensure the balance of privacy and right of access. 

e Partnering in the delivery of orientation sessions to new employees joining 
Industry Canada. 


Information Management Initiatives 


As noted earlier, effective and efficient information management is crucial to IPRA 
maintaining its high-level performance and ensuring compliance with its legal 
obligations, IPRA contributes to a multi-year IM Agenda which guides the 
Department in delivering on its long-term Information Management (IM) program 
objectives, which are to support program and service delivery, foster informed 
decision-making, facilitate accountability, transparency and collaboration, and 
preserve access to information and records for the benefit of present and future 
generations. Initiatives under the IM Agenda are designed to achieve the following 
outcomes: 


e Effective IM Governance — The continuous and effective management of 
information is assured through appropriate governance structures, policies and 
guidelines. 


e IM Informed Workforce ~ Employees have the know-how and expertise to 
manage and access information to support business outcomes, 

e Sustainable Corporate Support — Corporate IM tools based on effective 
standards, methods and practices are in place, supported by a sustainable info- 
structure and infrastructure, 


ATIP Case Management Teal 


IPRA is implementing a new electronic ATIP Case Management tool, This new tool 
will improve monitoring and tracking, as well as address the increased reporting 
requirements, thereby allowing IPRA to manage its day-to-day workflow more 
effectively. 


Education and Training Activities 


Enhanced awareness and knowledge of ATIP obligations on the part of departmental 
officials improves compliance with legal obligations, turnaround times, and the quality 
of responses, 


In 2009-10, IPRA prepared and delivered 23 ATIP training sessions (including one to 
regional officials) and reached more than 600 employees. Upon request, sessions are 
tailored to suit the needs of a specific group. In addition to these formal sessions, an 
intranet site is used to create awareness and disseminate information to employees, 


IPRA also worked with other IM domains to develop and deliver a more integrated IM 
outreach program te departmental officials. Messages highlighted the eennections and 
inter-dependence existing between the ATIP functions and information management 
activities such as security classification, retention/disposal and business value of 
information, as well as providing practical tips and best practices. 


ATIP — Professianal Development Program 


Industry Canada’s ATIP — Professional Development Program (ATIP-PDP) has been 
in effect since 2005, Its purpose is to develop employees from the PM-01 to the PM- 
04 level within the ATIP function. The program’s objective is to provide management 
with a tool to recruit, train and retain resources interested in building a career in the 
ATIP field. The program has proven effective in the recruitment and development of 
resources, It has also reduced the number of lengthy staffing processes and actions, 
and has had a positive influence on retention and succession planning. 
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ea Impact Assessments (PIA) and Preliminary Privacy Impact Assessments 


When the PIA Policy came into effect, IPRA established a process for Industry 
Canada that consisted of the following: . 


1, PPIA and/or PIA is prepared by the responsible Sector/Project Manager; 

2, PPIA/PIA is forward to IPRA for review, discussion, approval and reporting 
purposes; 

3, Once a PIA is finalized and approved, IPRA provides a copy to the Office of 

the Privacy Commissioner (OPC) for review; 

OPC will return the PIA with recommendations, as required; 

IPRA will return the PIA with recommendations to the Sector/Project Manager 

for action; 

6, IPRA will liaise between the Department and OPC as required until the PIA is 
finalized; 

7. Once complete, the Sector/Project Manager is to prepare a brief summary of 
the PIA for publication purposes and/or posting on the websites; and, 

8. IPRA will report on all PPIAs and PIAs at the end of each fiscal year in the 
Department’s Annual Report to Parliament on the Administration of the 
Privacy Act, 


we 


There were no PIAs initiated or completed during this reporting period and, therefore, 
none were forwarded to the Office of the Privacy Commissioner. 


As noted in Appendix I, a total of 20 PPIAs were initiated, reviewed and completed 
during this reporting period. The PPIAs consisted, for the most part, of updates to 
existing electronic tools/ applications related to existing programs and initiatives, and 
based upon legislative requirements. It was also determined that the PPIAs described 
enhanced tools with little change to content and that there was no change to the 
purpose, collection, use, disclosure and retention of personal information. 


In addition, it was concluded that the content was related to commercial/business 
information required by the Department to deliver on its mandate. Personal 
information in these cases consisted of a name and contact information, which was a 
business address required for communication purposes. 


Disclosures Made Pursuant to Paragraph 8(2) — Permissible Disclosures 
e Section 8(2)(e) — disclosure made to an investigative body (as described in the 


Regulations): A total of three requests were received and completed during this 
reporting period. 


1] 


e Section 8(2)(m) — disclosure in the public interest: No disclosure was made 
during this reporting period. 


Data-Matching and Data-Sharing Activities 


This Department is not active in any data-matching or data-sharing activities and as a 
result, there are no activities of this nature to report for 2009-10. 


Privacy Impact of any Legislative, Policy and Service Delivery Initiatives (Including 
Data-Matching and Data-Sharing Agreements) 


There is no information to report with regard to this item for 2009-10. 


Improvements to Privacy Pratection 


A Departmental Security Policy was introduced on October 1, 2006. The Security 
Policy is designed to protect employees, preserve the confidentiality, integrity, 
availability and value of Industry Canada’s departmental assets, and assure the 
continued delivery of services, 


Info Source 


IPRA is responsible for providing a full accounting of the Department’s information 
holdings to the Treasury Board Secretariat and it ensures that updates are provided on 
a timely basis for inclusion in Info Source. Info Source may be obtained through 
public and academic libraries, or may be viewed online at 

ind 


In 2009-10, IPRA updated the work plan concerning the renewal of Info Source and 
began implementing the process te update the existing Personal Information Banks 
(PIBs) listed for Industry Canada, including the Standard PIBs in accordance with 
Treasury Board Secretariat directives. The renewal of Info Source will also reflect the 
last approved Program Activity Architecture (PAA) for the Department. 


Use of CDs 
This initiative has reduced paperburden and eliminated reproduction fees and on-site 


visits from applicants, as well as improved timeliness and efficiency in managing the 
ATIP program and services. The Department does not charge for CDs. 
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Informal Practices 


Consistent with the principle that the Act is intended to complement, rather than 
replace, existing procedures for access to government information, informal requests 
may be addressed directly to branches within the Department. IPRA routinely directs 
requesters to the relevant sectors with public research centers or public sites. 


Publicly Accessible Information, Website and Enquiry Points 


The Department is broad and diverse in nature and manages various distinct laws that 
legally allow for publicly accessible information. Industry Canada has a 
comprehensive website and provides a number of enquiry points where the public may 
submit a query and obtain information on an informal basis, specifically: 


ic.gc.ca 

Canada Business 

Canadian Consumer Information Gateway 
Canadian Intellectual Property Office 
Corporations Canada 

Office of the Superintendent of Bankruptcy 


ATIP Website 


IPRA also has its own internet site (www.ic. 
The site contains general information, points of contacts and links to other key 
departments and agencies, including the ATIP Offices for the Industry Portfolio. 


Reading Rooms 
A reading room is available at Industry Canada headquarters and in all regional offices 


as required. Current departmental manuals are available for review by the public upon 
request. The manuals may also be provided electronically. 
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PRIVACY — TRENDS AND STATISTICS 


Significant Trends 


As stated earlier, Industry Canada’s mandate is focused on Canadian businesses. The 
Department's programs and initiatives assist in building a mere productive, 
competitive and knowledge-based economy for Canada. As a result, there are few 
privacy requests and issues. 


Since there were few official requests received during the reporting period, no 
significant trend was noted. The few privacy requests received involved issues related 
to staffing exercises (such as rating guides and screening processes), performance, 
personal comments and bankruptcy files held by the Office of the Superintendent of 
Bankruptcy. 


A summarized statistical report on Privacy Act requests processed from April 1, 2009 
to March 31, 2010, is found in Appendix I. An explanation and interpretation of 
information contained in the appendix follows. 

I. Requests Received under the Privacy Act 

Of the 35 requests processed during this reporting period, three were outstanding from 
previous years and 32 requests were new. Two requests were carried forward into the 
new fiscal year. A total of 33 requests were completed and more than 7,300 pages 
reviewed, 

II. Disposition of Requests Completed 

Of the 35 active requests, 33 were completed during the 2009-10 reporting period and 
two requests remained to be processed as of March 31, 2010. The completed requests 
fall into the following categories: 

All Disclosed — In 14 cases, the requester was granted full access. 

Disclosed in Part — In six cases, the requesters were granted partial access. 

Unable to Process — 11 requests could not be processed. 


Abandoned by Applicant — two requests were abandoned by the applicant. 


Transferred — No requests were transferred. 


III. Exemptions Invoked 


As noted in Appendix I, the Department invoked exempting provisions pursuant to 
sections 26 and 27 of the Privacy Aet. 


IV. Exclusions Cited 
The Department did not invoke any exclusions pursuant to the Act. 
V. and VI. Completion Time and Extensions 


Of the 33 completed cases, the Department was able to respond within the legislated 
30 days or less in 13 cases, or 40 pereent of the time. Approximately 24 percent of 
completed cases required extensions under the Act to allow external consultation with 
other government departments and agencies, and 30 percent were completed within 31 
to 60 days. Of the remaining 10 requests, 18 percent were completed within 61 to 120 
days and 12 percent over 121 days for a total 30 percent completed after the legislated 
time period as noted in Appendix I. 


VII. Translations 

No translations were undertaken in dealing with these requests. 

VIII. Method of Access 

In response to 20 requests, copies of the records were provided to the applicants by 
hard copy or by transferring the records onte CDs, There were no requests for on-site 
examination. 

IX. Corrections and Notation 


No requests for corrections or notation were received. 


X. Costs 


wr 


Total salary costs associated with administering Privacy Act activities were estimated 
at $67 567 for this reporting period. Non-salary costs were estimated at $11 596 fora 
total cost of $79 163, The associated human resources (including both IPRA and 
departmental officials) required to fulfill this function were estimated at one full-time 
employee. 
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Applicants have the right of complaint pursuant to the Act and may exercise this right 
at any time during the processing of their request. The Department received two 
complaints for this reporting period, One complaint was related to use and disclosure 
while the other involved right of access. The complaint investigations were completed 
and the Privacy Commissioner concluded that the complaints were not well-founded. 


No appeals were filed with the Federal Court of Canada during the reporting period. 


Office of the Privacy Commissioner of Canada 


Other than the complaints noted above, there is nothing to report for 2009-10. 


Office of the Auditor General of Canada 


There is nothing to report for 2009-10. 
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PRIVACY ACT 


REPORT ON THE PRIVACY ACT 


0 we Government Governement 
of Canada du Canada 
RAPPORT CONCERNANT LA LOI SUR LA PROTECTION 
DES RENSEIGNEMENTS PERSONNELS 
[Institution ; aa > marie) INDUSTRY CANADA | Reporting period Période visée par le rapport 
| INDUSTRIE CANADA | 4/1/2009 to/a 3/31/2010 
Requests under the Privacy Act 
Demandes en vertu de /a Loi sur la Exclusions cited Translations 
protection Exclusions citées Traductions 
i Received during reporting period ie 32 Ss. 0 Translations requested 4 0 
; Regues pendant la période visée par le rapport Art. 69(1)(a) i Traductions demandées ' 4 
Outstanding from previous period 3 | (b) 0 | Translations | English to French | 0 
jen suspens depuis la période antérieure | | | prepared De |'anglais au francais 
Se Ss. | | Traductions | French to English 
Soa 35 Art. 70(1)(a) 0 i | préparées Du frangais a l'anglais 0 
a =e 2 ae A et 
Completed during reporting period 33 (b) ie 0 
| Traitées pendant la période visée par le 
Carried forward 9 0 Method of access 
Reportées (c) Méthode de consultation 
: Z Cie ae ; aes aaa : 
é Bs Copies given 
Disposition of requests completed (d) 0 Meee 20 
i | Disposition a I'égard des demandes traitées voll Copies ga fenginat 
af Se ee LAS oi ol = Examination 
1. All disclosed 14 (e) 0 Examen de I'original 
Communication totale a 
ir ass 5 af (f) 0 Copies and examination 
2, | Disclosedinpart Copies et examen 
Communication partielle +, 
3 Nothing disclosed (excluded) 
F Aucune communication (exclusion) <a 
iF : ; x el ears Corrections and notation 
4 Nothing disclosed (exempt) Completion time Corrections et mention 
: Aucune communication (exemption) Délai de traitement ? 
r + are = Corrections requested 0 
5, | Unable to process 11 30 days or under | 13 Corrections demandées 
Traitement impossible 14 bear oA 30 jours ou moins id ete 2 fe 2 
5, __| Abandoned by applicant o | | 31 to 60 days 10 pgs eee 0 
. Abandon de la demande De 31 @ 60 jours ae aE a * 
‘Game 3G Ste are =f ” a lotation attache 
7 Transferred 0 61 to 120 days | 6 Mention annexée i 0 
Wee. Transmission eee sani cal De 61 & 120 jours | ~ -1 ———— 
| 121 days or over 
TOTAL ; Costs 
| ‘ Z - if ii 33 | 121 jours ou plus 4 Cotts 
Exemptions invoked Financial (all reasons) : % ' 
Exceptions invoquées Financiers (raisons) ($000) 
Ss. Extensions Salary 
Art. 18(2) 0 Prorogations des délais Traitement i 67,567.0 
a a ie ae 
S. 0 | 30 days or under 31 days or over Administration (O and M) 1 4 596 0 
Art. 19(1)(a) Z 30 jours oumoins | 31 jours ou plus Administration (fonctionnement et maintien) ' : 
: FEE EN Seay ere |e 4 } se = 4 
| Interference with operations | 
b | 
() 0) Interruption des opérations 0 0 TOT: | 79, 163.0 
(c) 0 Consultation 8 0 
(a) 0 Translation 0 0 Person year utilization (all reasons) 
| Traduction Années-personnes utilisées (raisons) 
S. Person year (decimal format) 
Art. 20 0 Bh ee 8 0 Années-personnes (nombre décimal) 1 -00 
Ss. 
Art. 21 0 
is a= > 
Art. 22(1)(a) 0 
(b) 0 
(c) 0 | 
e ee 
Art. 22(2) 0 : 
S. | 
Art. 23(a) 0 | 
t -——- + 
(b) 0 
: = 
| Art. 24 0 | 
Ss. 
Art. 25 0 
Ss: 
a 4 : 
Ss. 
Art. 27 1 
ie — —— — + 
S 
At. 28 0 | 


Appendix B 


Annexe B 


compliance with the Privacy Impact 


conformité a la Politique sur I'Evaluation des 


Assessment (PIA) Policy (which eame into 
effect on May 2, 2002) through a variety of 
means, Institutions are therefore required 
to report the following information for this 


facteurs relatifs a la vie privée (EFVP) (qui est 
entrée en vigueur le 2 mai 2002) par divers 
moyens, Les institutions sont donc tenues de 
déclarer les renseignements suivants pour cette 


reporting period. 


Indicate the number of: 


Preliminary Privacy Impact Assessments 
initiated: 20 


Preliminary Privacy Impact Assessments 
completed: 20 


Privacy Impact Assessments 
initiated: __0 


Privacy Impact Assessments 


completed: O 


période de déclaration. 


Veuillez indiquer le nombre : 


d’évaluations préliminaires des facteurs relatifs a la 


vie privee amorcées : 20 


d’évaluations préliminaires des facteurs relatifs a la 
vie privée achevees : 20 


d’évaluations des facteurs relatifs a la vie privée 
amorcées : 


d'évaluations des facteurs relatifs a la vie privée 


achevées;, 3 oO 


d'évaluations des facteurs relatifs a la vie privée 
acheminées au Commissariat a la protection de la 


vie privée (CPVP) : is) 


Si votre institution n'a pas entrepris l'une ou l'autre 
des activités susmentionnées durant la période de 


rapport, cela doit étre mentionné de fagon explicite. 


Privacy Impact Assessments forwarded to the 
Office of the Privacy Commissioner (OPC): 


If your institution did not undertake any of the 
activities noted above during the reporting 


period, this must be stated explicitly. 


No discrepancies to report 


Annexe C 


APPENDIX I — IPRA ORGANIZATIONAL 


STRUCTURE 


IPRA Organization / 
Organization de P ADIPRP 


5 K. Eadie 
Director / Direetrice 


EX-01 


§.Guber 
Executive Asst/ Ad, Executive F- 
ASO 


L. Lebel 


E, Fraser 
Manager / Gestionnaire 


L Asselin 
Manager / Gestionnaire 
PM-06 


Manager / Gestionnaire 
PM06 


PMB 


~ D. Bourgeaut | 
Sr. ATIP Advisor/ Agente service ala clientéle | 
Conseiler prine. CAIPRP PM-02 
PM0S 


Vacant 
Sr. ATIP Advisor/ 
Conseiller prince. dAIPRP 
PM-05 


M. Teske 
Sr, ATIP Advisor / 
Conseillére prince. dAIPRP 
PM-05 


Vacant 
Sr. ATIP Advisor / 
Conseiller prine. AIPRP 
PN-05 


L. Praine 
C. Walton 
ATIP Advisor/ 
Conseillére d'AIPRP 
PM-04 


R. Diaz-Rivas 
ATIP Advisor / 
Conseiller dAIPRP 
PM-04 


Sr. ATIP Advisor / 
Conseillére prince, dAIPRP 
PM-05 


R. Roy 

ATIP Advisor/ 
Conseillere dAIPRP 
PM-03 


T. Wagdin 
ATIP Advisor/ 
Conseillére ¢AIPRP 
PM-04 
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Industry Canada / Industrie Canada 


Access to Information Act and Privacy Act Delegation Order 


Arrété sur la délégation en vertu de la Loi sur l’accés a 
information et de la Loi sur protection des renseignements 
personnels 


The Minister of Industry Canada, pursuant 
to section 73 of the Access to Information 
Act and the Privacy Act, hereby designates 
the persons holding the positions set out in 
the schedule hereto, or the persons 
occupying on an acting basis those positions, 
to exercise the powers and functions of the 
Minister as the head of a government 
institution, under the section of the Acts set 
out in the schedule opposite each position. 
This Delegation Order supersedes all 
previous Delegation Orders. 


En vertu de ]’article 73 de la Loi sur l’accés 
a l'information et la Loi sur la protection 
des renseignements personnels, le Ministre 
d’Industrie Canada délégue aux titulaires des 
postes mentionnés a ]’annexe ci-aprés, ainsi 
qu’aux personnes occupant 4 titre 
intérimaire les-dits postes, les attributions 
dont il est, en qualité de responsable d’une 
institution fédérale, investie par les articles 
des lois mentionnées en regard de chaque 
poste. Le présent décret de délégation 
remplace et annule tout décret antérieur. 


Schedule / Annexe 


Position / Poste 


Assistant Deputy Minister, 
Smal] Business and absolue 
Marketplace Services / 

Sous-ministre adjoint(e), 

Services axés sur Je marché 

et les petites entreprises 


Director General, 
Information Management 
Branch (IMB) / Directeur absolue 
(trice) général, Gestion de 

information (DGI) 


Access to Information Act and. 
Regulations / Loi sur ]’accés a 
l’information et réglements 


Full authority / Autorité 


Full authority / Autorité 


Privacy Act and Regulations / 
Loi sur la protection des 
renseignements personnels et 
réglements 


Full authority / Autorité 
absolue 


Full authority / Autorité 
absolue 


Director, Information and 
Privacy Rights 


Full authority / Autorité 
absolue 


Full authority / Autorité 
absolue 


Administration (IPRA), 
Information Management 
Branch (IMB) Directeur 
(trice), Administration des 
droits a |’information et a la 
protection des 
renseignements personnels 
(ADIPRP), Gestion de 

I’ information (DGGI) 


Full authority / Autorité 
absolue 


Full authority / Autorité 


Manager, IPRA-IMB / 
absolue 


Gestionnaire, ADIPRP- 
DGGI 


and 


Sections / Articles : 8(1), 
14, 15, 19, 20, 21, 22, 23, 
24,25, 26, 27, 28, 69, 70 


Senior Advisor IPRA, IMB Sections / Articles: 7, 8(1), 


/ Conseiller (ére) 9, LAS) ALB 14 sho 16, 
principal(e), ADIPRP - LAS ALS eZORZ le? 2 3n 
DGI ‘ 24, 25, 26, 27(1), 68, 69 


Daté, en la ville d’Ottawa 


Dated, at the City of Ottawa 
cet Sour de jail 2008 2009 


this /* day of July , 2008 009 


THE HONOURABLE MINISTER CLEMENT 


MINISTER/OF/INDUSTRY CANADA“ 


~ MINISTRE D’ INDUSTRIE CANADA 
L?> HONORABLE MINISTRE CLEMENT 
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PREFACE AND PURPOSE 


The Privacy Act (Revised Statutes of Canada, Chapter A-1, 1985) was proclaimed on 
July 1, 1983. 


The purpose of the Privacy Act “is to extend the present laws of Canada that protect 
the privacy of individuals with respect to personal information about themselves held 
by a government institution and to provide individuals with a right of access to that 
information” (Section 2 of the Act). The law also protects an individual’s privacy by 
preventing others from having access to that personal information and allows an 
individual specific rights concerning the collection and use of his/her information. 


Section 72 of the Privacy Act requires that the head of every government institution 
prepare for submission to Parliament an annual report on the administration of this Act 
within the institution during each financial year. 


This annual report describes how Industry Canada administered its responsibilities in 
the twenty-eighth year of operation of the Privacy Act. 


ABOUT THE ORGANIZATION 


Industry Canada’s Mission and Mandate 


Industry Canada’s mission is to foster a growing, competitive, knowledge-based 
Canadian economy. The Department works with Canadians throughout the economy, 
and in all parts of the country, to improve conditions for investment, improve 
Canada’s innovation performance, increase Canada’s share of global trade, and build 
an efficient and competitive marketplace. 


Industry Canada’s mandate is to help make Canadian industry more productive and 
competitive in the global economy, thus improving the economic and social well- 
being of Canadians. The many and varied activities Industry Canada carries out to 
deliver on its mandate are organized around three interdependent and mutually 
reinforcing strategic outcomes, each linked to a separate key strategy. The key 
strategies are shown in the illustration below. 


Prosp: 


petitiveness 


e The Canadian marketplace is efficient and competitive 


Advancing the marketplace 


Industry Canada fosters competitiveness by developing and administering 
economic framework policies that promote competition and innovation; support 
investment and entrepreneurial activity; and instill consumer, investor and 
business confidence. 


¢ Science and technology, knowledge, and innovation are effective drivers of a 
strong Canadian economy 


Fostering the knowledge-based economy 


Industry Canada invests in science and technology to generate knowledge and 
equip Canadians with the skills and training they need to compete and prosper in 
the global, knowledge-based economy. These investments help ensure that 
discoveries and breakthroughs take place here in Canada and that Canadians 
realize the social and economic benefits. 


e Competitive businesses are drivers of sustainable wealth creation 
Supporting business 


Industry Canada encourages business innovation and productivity because 
businesses generate jobs and wealth creation. Promoting economic development in 
communities encourages the development of skills, ideas and opportunities across 
the country. 


Context and Environment 


Industry Canada works on a broad range of matters related to industry and technology, 
trade and commerce, science, consumer affairs, corporations and corporate securities, 
competition and restraint of trade, weights and measures, bankruptcy and insolvency, 
intellectual property, investment, small business, and tourism. 


Given the role the Department plays in promoting economic development and 
regulating the marketplace, there is significant public interest in the information 
collected and produced. Key areas of interest in 2010-2011 included the auto industry, 
tourism, small business, gas pricing, changes to the mandatory long-form census, as 
well as various statutes, namely the Competition Act, the Canada Investment Act and 
the Copyright Act and decisions related to these Acts. 


A government initiative that sparked a lot of interest was the change to the mandatory 
nature of the long-form census survey. As Statistics Canada is an agency which 
reports to our Minister, the Department worked closely with Statistics Canada to 
respond to the requests on this topic. 


Industry Canada also saw an increase in requests of a general nature, related to the 
overall business activities of the Department, such as overviews of briefings for the 
Minister. 


In 2010-2011 Industry Canada continued to play an important role in implementing 
the Government of Canada’s Economic Action Plan (EAP), introduced in January 
2009 as part of Budget 2009. This plan, which consisted of a set of initiatives to be 
implemented over a two-year timeframe, for completion by March 31, 2011, aimed at 
providing a quick recovery from the economic downturn and ensuring long-term 
economic growth and prosperity for Canadian businesses and individuals. 


The high profile EAP initiatives implemented by Industry Canada included 
distribution of stimulus funding to traditional industries, including the manufacturing 
sector, and providing assistance to the Canadian automotive sector to support the 
orderly restructuring of this critical industry, with the goal of maintaining Canada’s 
share of North American production. 


In addition, through the Knowledge Infrastructure Program, the Department is 
providing $2 billion over two years to create jobs in communities across Canada by 
revitalizing research and training facilities at Canadian universities and colleges. On | 
December 2, 2010, the Government of Canada announced the extension of the 
deadline for completion of Economic Action Plan infrastructure projects from March 
31, 2011 to October 31, 2011. The Knowledge Infrastructure Program is the only 
Industry Canada program impacted by this announcement. C 


In response to the gas pump measurement accuracy issue, which over the last two 
years has resulted in many repeat requests for Measurement Canada’s gas pump 
inspection reports, the Fairness at the Pumps Act was introduced and passed by the 
Senate on March 3, 2011. The Act is designed to protect Canadian consumers from 
inaccurate measurements when purchasing gasoline or other measured goods. 


These initiatives have generated significant public interest in the activities of the 
Department. 


Departmental Structure 


The Department employs over 5900 people across the country, including economists, 
engineers, scientists, commerce officers, inspectors, metrologists, and accountants 
supported by specialists in areas such as human resources, financial management, 
communications, information management and information technology. 


The Department is organized into 15 sectors and branches (see www.ic.gc.ca). 
Industry Canada has its headquarters in Ottawa and several offices in the National 
Capital Region. The Department also has five regional offices (Pacific, Prairie and 
Northern, Ontario, Quebec, and Atlantic), located in Vancouver, Edmonton, Toronto, 
Montréal and Halifax, respectively. 


In addition, a number of programs have a regional presence, including those delivered 
by the Competition Bureau, Measurement Canada, the Office of the Superintendent of 
Bankruptcy, the Spectrum, Information Technologies and Telecommunications Sector 
and the Federal Economic Development Initiative for Northern Ontario (FedNor). 


. Each of these sectors and branches is responsible for searching and retrieving 
documents responsive to official access requests received under the Access to 
Information Act and Privacy Act (ATIP). However, Information and Privacy Rights 
Administration (IPRA) is legally responsible for implementing and managing the 
ATIP program and services for Industry Canada, including decisions on the release or 
non-release of information pursuant to the legislation. 


Information Management Branch 


Given that the effective management of information is critical to the administration of 
the Access to Information Act and Privacy Act, IPRA resides with the Information 
Management Branch (IMB), a branch in the Small Business, Tourism and Marketplace 
Services Sector (SBTMS). IMB directs and supports an Information Management 
(IM) program to ensure the effective and efficient management of information within 
Industry Canada. The IM program provides strategic direction and services related to 
recordkeeping, public access to departmental information, departmental access to 
commercially published information and information management policy, 
accountability, governance, planning and reporting. As a result, departmental program 
managers can more readily deliver their programs and services, as well as meet their 
obligations under the Government’s Policy on Information Management, the Library 
and Archives Canada Act, the Access to Information Act, the Privacy Act and the 
Federal Accountability Act. Further, it ensures that the Department respects the 
intellectual property rights of commercial publishers. 


IMB provides services to the Department from four Directorates: Corporate Integrated 
Records Services (CIRS), the Library and Knowledge Centre (LKC), IM Policy, 
Planning and Innovation (IMPPI), and Information and Privacy Rights Administration 
(IPRA). 


Information and Privacy Rights Administration 


IPRA is responsible for the implementation and management of the Access to 
Information Act and Privacy Act programs and services for Industry Canada. 
Specifically, IPRA makes decisions on the disposition of access requests; promotes 
awareness of the legislation to ensure departmental responsiveness to the obligations 
imposed by law; monitors and advises on departmental compliance with the Acts, 
regulations, procedures and policies; and acts as the spokesperson for the Department 
when dealing with the Treasury Board Secretariat, the Information Commissioner, the 


Privacy Commissioner, and other government departments and agencies. IPRA is also 
responsible for conducting consultations with other federal departments with respect 
to access to information and privacy issues. 


IPRA has a complement of 14 employees including one Director, three managers, 
eight advisors and two support staff, all of whom are dedicated to processing access 
and privacy requests, along with related functions. 


Delegation of Authority 


The current Access to Information and Privacy (ATIP) Delegation Order was 
approved by the Minister in July 2009, and provides full-delegated authority to the 
Assistant Deputy Minister of SBTMS, the Director General of IMB, the Director and 
the managers of IPRA. The designation of the Director General position is for 
purposes of providing strategic support and advice to the executive management of . 
the Department concerning ATIP issues, if and when required. For all daily ATIP 
activities and operations, the Director and the managers of IPRA exercise full 
responsibility (see Appendix III). 


The Director of IPRA is responsible for the development, coordination and 
implementation of effective policies, guidelines and procedures to manage the 
Department’s compliance with the Acts. The administration of the legislation in 
Industry Canada is managed by IPRA, but is also facilitated at the sector, branch and 
regional office levels. Each sector and corporate branch has an ATIP Liaison Officer 
(reporting to an Assistant Deputy Minister, Regional Executive Director, etc.) who 
coordinates activities and provides guidance on the administrative processes and 
procedures of the Acts. IPRA, which is located in Ottawa, responds to all formal 
requests submitted under the applicable Acts. 


2010-2011 Highlights 


In 2010-2011, the Department saw a decrease in the volume of privacy requests 
received under the Privacy Act as compared to the previous year. In total 16 formal 
requests were received as compared to 32 in 2009-2010. However, processing 
requests is just one component of the administration of privacy rights. 


Activities also include awareness, training, and the provision of advice and guidance 
regarding the collection and management of personal information within Industry 
Canada. IPRA also reviews and approves Preliminary Privacy Impact Assessments 
(PPIAs) and Privacy Impact Assessments (PIAs) which are core documents of the 
Department’s governance framework for IT projects. In addition, departmental 
officials regularly consult with IPRA to seek guidance on the rules related to 


consistent use and/or disclosure of information in accordance with the purpose for 
which the information was obtained or compiled. 


e Resources — Human and Financial 


In 2010-2011, IPRA continued to face challenges in managing and retaining staff to 
perform its daily operations and meet its legal compliance requirements. The office 
had four departures during the year which represents a churn rate of 29 percent. Three 
of the departures were in the last quarter and staffing processes were initiated to fill 
the resulting vacancies. A new organizational structure was implemented in 2009- 
2010 to better meet the increasing business demands and to allow IPRA to expand on 
policy advice and outreach services. However, there was no increase in the FTE 
allotment. IPRA consists of three teams (see Appendix II), with two teams responsible 
for the daily operations and one for policy and outreach. IPRA continues to operate 
within an allocation of 14 full-time employees, unchanged since 2003. 


Providing interesting work and opportunities for growth are critical to retaining 
employees and lowering the departure rate. To attract and retain employees in a highly 
competitive market, IPRA provides career progression opportunities with the use of 
the ATIP Professional Development Program (ATIP-PDP). The Program, which has 
been in effect since 2005, is used to develop employees from the PM-01 to the PM-04 
level within the ATIP function. 


The Program’s objective is to provide management with a tool to recruit, train and 
retain resources interested in building a career in the ATIP field. The program has 
proven effective in the recruitment and development of resources. It has also reduced 
the number of lengthy staffing processes and actions, and has had a positive influence 
on retention and succession planning. In 2010-2011, one IPRA employee graduated to 
the PM-04 level and one new candidate joined the program. IPRA has also been 
innovative in using inter-departmental staffing processes and other 
recruitment/staffing tools, which have positively improved recruitment outcomes. 


IPRA also supports employees’ career objectives by providing training opportunities 
to support both short and long-term career goals. 


e Resources and Workload 


Of the 14 IPRA positions, 13 were staffed for the majority of the reporting period. 
The 13 positions consisted of the Director, three managers (PM-06), three senior 
advisors (PM-05), three advisors at the PM-04 level and one at the PM-02 level, plus 
two support positions (PM-02 and AS-01). During the period under review IPRA had 
to contend with a number of resourcing issues, not least of which was the departure of 


three staff members in the fourth quarter. During part of the reporting period, a 
consultant was hired to assist with the workload. 


In 2010-2011, the policy and outreach unit, consisting of two people (PM-06 and PM- 
05), was responsible for maintaining the various partnerships with other functional 
areas, overseeing various projects/initiatives (e.g., ATIP case management tool, IM 
initiatives, Info Source Renewal, etc.), and delivering ATIP advice/guidance including 
providing training and awareness sessions across the Department. Mid-year, due to 
operational changes, the unit was reduced to one person. Even with the reduction, the 
following activities were completed: 


ACTIVITY - TOTAL 
(Questions/Reviews 
/Emails/ Reports, 


Provide ATIP guidance and advice to Industry Canada officials, 
OGDs and the public 


Review of audit and evaluation reports prior to being publicly 
posted on the departmental website 


| Review of parliamentary questions and responses 9 


2 
Review of proactive disclosures prior to being publicly posted 1510 
on the departmental website (Emails) 


Prepare and deliver ATIP training/awareness sessions to 36 
departmental officials (including regions) 
Review and approval of Preliminary Privacy Impact oT 
Assessments/Privacy Impact Assessments 

OTHER 


Update to IPRA internal intranet site 
Preparing and tabling annual reports and statistical reports 
Input to MAF and DPR (ATIP user fees) . 


Managing Info Source updates and providing submission to 
TBS 


Review and update business practices and procedures for IPRA 
Participate in various initiatives across IC (Email Back-Up, 
various IM policy initiatives, Business-Based Classification 
Structure, etc.) 


Other Activities 
Disclosures Made Pursuant to Paragraph 8(2) — Permissible Disclosures 


» Section 8(2)(d) — disclosure to the Attorney General of Canada: One disclosure 
was made during this reporting period. 


» Section 8(2)(e) — disclosure made to an investigative body (as described in the 
Regulations): Two requests were received during this reporting period — one was 
abandoned and one was completed. 


b Section 8(2)(m) — disclosure in the public interest: No disclosure was made 
during this reporting period. 


Data-Matching and Data-Sharing Activities 

This Department is not active in any data-matching or data-sharing activities and as a 
result, there are no activities of this nature to report for 2010-2011. 

Privacy Impact of any Legislative, Policy and Service Delivery Initiatives (Including 
Data-Matching and Data-Sharing Agreements) 


There is no information to report with regard to this item for 2010-2011. 


IPRA — ATIP Procedures, Business Practices, and Policies 


To improve the administration of the ATIP program, and to ensure that Treasury 
Board ATIP policies are respected and implemented, IPRA has developed various 
internal guidelines, procedures, and business practices. The areas covered include the 
following: 


OPERATIONAL PROCEDURES 


e ATIP Procedures for IPRA Staff 


A comprehensive guide of the ATIP Office’s business practices and procedures was 
developed to reduce the learning curve of new employees, as well as to provide a 
reference tool for staff. During development existing ATIP business processes were 
reviewed and challenged in an attempt to reduce administrative burden and improve 
the day-to-day workflow of the office. 


e Helping Applicants through Duty to Assist 


Over the years, IPRA has implemented various approaches to better assist and respond 
to applicants. Established practices include the following: 


The applicant’s identity is not considered during the processing of a request, 
nor is it revealed to departmental officials, unless there is a need to know to 
retrieve information and/or if consent is provided by the applicant; 

Regular communication is established with applicants to clarify and narrow 
requests, provide updates and explain the privacy process and rights pursuant 
to the Act; 

Accurate, timely and complete responses are compiled in good faith. Alternate 
solutions may be suggested, such as previously released, or publicly accessible 
information, and, if applicable, referrals to other organizations involved; 
Records are provided in the format requested. Since 2001, IPRA has been 
providing processed documents on CD-ROM in PDF format at no cost to the 
applicant. At times, releases of data extracts are provided in Excel, Lotus 
and/or ASCII format and if the material is less than 125 pages, a paper copy is 
provided; and 

Other practices involve facilitating discussions and/or meetings with program 
officials and providing interim responses when possible. 


BUSINESS PRACTICES IN SUPPORT OF TBS POLICIES 


Privacy Impact Assessments (PIA) and Preliminary Privacy Impact Assessments 


(PPIA) 


When the PIA Policy came into effect, IPRA established a process for Industry 
Canada that consisted of the following: 


i 


PPIA and/or PIA is prepared by the responsible Sector/Project Manager; 


2. PPIA/PIA is forwarded to IPRA for review, discussion, approval and reporting 


purposes; 

Once a PIA is finalized and approved, IPRA provides a copy to the Office of 
the Privacy Commissioner (OPC) for review; 

OPC will return the PIA with recommendations, as required; 

IPRA will return the PIA with recommendations to the Sector/Project Manager 
for action; 

IPRA will liaise between the Department and OPC as required until the PIA is 
finalized; 

Once complete, the Sector/Project Manager is to prepare a brief summary of 
the PIA for publication purposes and/or posting on the websites; and, 


8. IPRA will report on all PPIAs and PIAs at the end of each fiscal year in the 
Department’s Annual Report to Parliament on the Administration of the 
Privacy Act. 


There were no PIAs initiated or completed during this reporting period and, therefore, 
none were forwarded to the Office of the Privacy Commissioner. 

As noted in Appendix I, a total of 27 PPIAs were initiated, reviewed and completed 
during this reporting period. The PPIAs consisted, for the most part, of updates to 
existing electronic tools/applications related to existing programs and initiatives, and 
based upon legislative requirements. It was also determined that the PPIAs described 
enhanced tools with little change to content and that there was no change to the 
purpose, collection, use, disclosure and retention of personal information. 


In addition, it was concluded that the content was related to commercial/business 
information required by the Department to deliver on its mandate. Personal 
information in these cases consisted of a name and contact information, which was a 
business address required for communication purposes. 


e Use of CDs 


This initiative has reduced paper burden and eliminated reproduction fees and on-site 
visits from applicants, as well as improved timeliness and efficiency in managing the 
ATIP program and services. The Department does not charge for CDs. 


e Informal Practices 


Consistent with the principle that the Act is intended to complement, rather than 
replace, existing procedures for access to government information, informal requests 
may be addressed directly to branches within the Department. IPRA routinely directs 
requesters to the relevant sectors with public research centers or public sites. 


e Publicly Accessible Information, Website and Enquiry Points 


The Department is broad and diverse in nature and manages various distinct laws that 
legally allow for publicly accessible information. Industry Canada has a 
comprehensive website and provides a number of enquiry points where the public may 
submit a query and obtain information on an informal basis, specifically: 


» ic.gc.ca 
» Canada Business 
® Canadian Consumer Information Gateway 


1] 


» Canadian Intellectual Property Office 
» Corporations Canada 
» Office of the Superintendent of Bankruptcy ~ 


© ATIP Website 


IPRA also has its own internet site (www.ic.gc.ca/eic/site/atip-aiprp.nsf/eng/home). 
The site contains general information, points of contacts and links to other key 
departments and agencies, including the ATIP Offices for the Industry Portfolio. 


e Info Source 


IPRA is responsible for providing a full accounting of the Department’s information 
holdings to the Treasury Board Secretariat (TBS) and it ensures that updates are 
provided on a timely basis for inclusion in Info Source. 


In 2010-2011 an extensive review and update of the Department’s Info Source 
Chapter was completed with the collaboration of program officials. The revised 2010- 
2011 Chapter contains complete descriptions of all IC functions, programs, activities 
and related holdings linked to Industry Canada’s Program Activity Architecture. 


All 38 of the Department’s institution-specific Personal Information Banks (PIBs) 
were reviewed and seven were de-registered and replaced with standard PIBs. In 
addition, the Department asked TBS to de-register a further 13 PIBs, however, 
approval is pending. Of the remaining 18 PIBs 16 were revised (approval is pending) 
and two remain unchanged. In addition, five Classes of Personal Information were 
deleted (approval is pending for two) and eight new Standard PIBs were registered 
with TBS. 


Info Source may be obtained through public and academic libraries, or may be viewed 
online at www.infosource.gc.ca/index-eng.asp. 

@ Reading Rooms 

A reading room is available at Industry Canada headquarters and in all regional offices 


as required. Current departmental manuals are available for review by the public upon 
request. The manuals may also be provided electronically. 
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Strategies and Initiatives to Ensure Compliance 
Ensuring Compliance through Training and Outreach 


Enhanced awareness and knowledge of ATIP obligations on the part of departmental 
officials improves compliance with legal obligations, turnaround times, and the quality 
of responses. During the reporting year, IPRA continued to work closely with various 


program areas of the Department to improve compliance and address issues related to 
privacy and overarching IM concerns. 


In 2010-2011, there was a 57% increase in ATIP awareness sessions prepared and 
delivered to Industry Canada employees (36 sessions as compared to 23 in 2009-2010), 


with approximately 550 participants. Upon request, sessions are tailored to suit the 
needs of a specific group. 


IPRA gave on-site training in all five of the Department’s regional offices, in 
partnership with the Regional Operations Sector, compared to two the previous year. 
Ongoing training was provided to Sector Liaison Officers, and sessions were provided 
to new employees, as part of the departmental orientation program. To date, awareness 
and training sessions have resulted in increased cooperation and collaboration with 
program officials across the Department. In some cases it has allowed improved 
negotiations with applicants to reduce the scope and volume of work and with time 
should improve the overall productivity and performance in managing the ATIP 
programs. In addition to these formal sessions, an intranet site is used to create 
awareness and disseminate information to employees. 


IPRA also participates and contributes to the Department’s IM Community of Practice, 
launched in July 2010, which provides a forum of discussion related to the 
development and implementation of Information Management best practices within 
Industry Canada in support of business and accountability. 


IPRA also worked with other IM domains to develop and deliver a more integrated IM 
outreach program to departmental officials. Messages highlighted the connections and 
inter-dependence existing between the ATIP functions and information management 
activities such as security classification, retention/disposal and business value of 
information, as well as providing practical tips and best practices. 


Mitigating Risk of Inappropriate Use and Disclosure of Information 
Over the past years, in an effort to mitigate the risk of releasing information which 


should be protected and to ensure the balance of privacy and right of access, IPRA has 
provided a number of services to core administrative functional areas. These include: 
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Comptrollership and Administration Sector (CAS) 
e As part of the government’s policy on the mandatory publication of travel and 
hospitality expenses for selected government officials (proactive disclosure), 
IPRA reviews the information regarding travel and hospitality expenses before 
it is posted publicly on the departmental website. The review ensures that no 
personal information is included in the information. 


Chief Informatics Office (CIO) 

e The governance framework for IT projects includes Threat and Risk 
Assessments, Preliminary Privacy Impact Assessments (PPIAs) and Privacy 
Impact Assessments (PIAs) among the core documents. IPRA is responsible 
for reviewing and approving the PPIAs and PIAs, and for providing advice to 
departmental officials regarding their content. 


Human Resources Branch (HRB) 
e Providing general advice and guidance concerning privacy issues related to 
employees; reviewing reports such as harassment/grievance/disciplinary to 
ensure the balance of privacy and right of access. 


Improvements to Privacy Protection 


A departmental Security Policy was introduced on October 1, 2006. The Security 
Policy is designed to protect employees, preserve the confidentiality, integrity, 
availability and value of Industry Canada’s departmental assets, and assure the 
continued delivery of services. 


Information Management Initiatives 


As noted earlier, effective and efficient information management is crucial to IPRA 
maintaining its high-level performance and ensuring compliance with its legal 
obligations. IPRA contributes to a multi-year IM Agenda which guides the 
Department in delivering on its long-term Information Management (IM) program 
objectives, which are to support program and service delivery, foster informed 
decision-making, facilitate accountability, transparency and collaboration, and 
preserve access to information and records for the benefit of present and future 
generations. Initiatives under the IM Agenda are designed to achieve the following 
outcomes: 


e Effective IM Governance — The continuous and effective management of 
information is assured through appropriate governance structures, policies and 
guidelines. 


14 


e IM Informed Workforce — Employees have the know-how and expertise to 
manage and access information to support business outcomes. 

e Sustainable Corporate Support — Corporate IM tools based on effective 
standards, methods and practices are in place, supported by a sustainable info- 
structure and infrastructure. 


ATIP Case Management Tool 


IPRA is implementing a new electronic ATIP Case Management tool. This new tool 
will improve monitoring and tracking, as well as address the increased reporting 
requirements, thereby allowing IPRA to manage its day-to-day workflow more 
effectively. 


The majority of the work to implement the new tool has been completed. However, 
due to the departure of three staff members in the fourth quarter, implementation has 
been deferred to fiscal 2011-2012. 
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PRIVACY — TRENDS AND STATISTICS 


Significant Trends 

As stated earlier, Industry Canada’s mandate is focused on Canadian businesses. The 
Department’s programs and initiatives assist in building a more productive, 
competitive and knowledge-based economy for Canada. As a result, there are few 
privacy requests and issues. 

Since there were few official requests received during the reporting period, no 
significant trend was noted. The few privacy requests received involved issues related 
to staffing exercises (such as rating guides and screening processes), performance, 


personal comments and bankruptcy files held by the Office of the Superintendent of 
Bankruptcy. 


Statistical Report — Interpretation and Explanation 


A summarized statistical report on Privacy Act requests processed from April 1, 2010 
to March 31, 2011, is found in Appendix I. An explanation and interpretation of 
information contained in the appendix follows. 

I. Requests Received. under the Privacy Act 

Of the 18 requests processed during this reporting period, two were outstanding from 
previous years and 16 requests were new. Three requests were carried forward into 
the new fiscal year. A total of 15 requests were completed and more than 7,800 pages 
reviewed. 


II. Disposition of Requests Completed 


15 requests were completed during the 2010-2011 reporting period, categorized as 
follows: 


All Disclosed — in two cases, the requester was granted full access. 

Disclosed in Part — in seven cases, the requesters were granted partial access. 
Unable to Process — two requests could not be processed. 

Abandoned by Applicant — three requests were abandoned by the applicant. 


Transferred — one request was transferred with the consent of the applicant. 
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III. Exemptions Invoked 


As noted in Appendix I, the Department invoked exempting provisions pursuant to 
sections 22 and 26 of the Privacy Act. 


IV. Exclusions Cited 
The Department did not invoke any exclusions pursuant to the Act. 
V. and VI. Completion Time and Extensions 


Of the 15 completed cases, the Department was able to respond within the legislated 
30 days or less 67 percent of the time. Approximately 7 percent of completed cases 
required extensions under the Act to allow external consultation with other 
government departments and agencies, and 13 percent were completed within 31 to 60 
days. Of the remaining three requests, 13 percent were completed within 61 to 120 
days and 7 percent over 121 days for a total 20 percent completed after the legislated 
time period as noted in Appendix I. 


VII. Translations 
One translation was undertaken in dealing with one request. 
VIII. Method of Access 


In response to nine requests, copies of the records were provided to the applicants on 
paper or on CDs. There were no requests for on-site examination. 


IX. Corrections and Notation 

No requests for corrections or notation were received. 

X. Costs 

Total salary costs associated with administering Privacy Act activities were estimated 
at $24 901 for this reporting period. Non-salary costs were estimated at $3 625 fora 
total cost of $28 526. The associated human resources (including both IPRA and 


departmental officials) required to fulfill this function were estimated at less than one 
(.3) of a full-time employee. 
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Complaints, Investigations and Appeals 


Applicants have the right of complaint pursuant to the Act and may exercise this right 
at any time during the processing of their request. The Department received two 
complaints for this reporting period. One was related to use and disclosure and one 
was related to refusal - general. During this period the Department completed two 
exemption complaints. The Privacy Commissioner concluded that one was well 
founded — resolved and one was not well founded - no action required; while two 
remain under investigation. 


No appeals were filed with the Federal Court of Canada during the reporting period. 


Changes Resulting from Issues Raised by Officers of Parliament 


Office of the Privacy Commissioner of Canada 


- In addition to the complaints noted above, Industry Canada’s Computers for Schools 
(CFS) program was subject to the Office of the Privacy Commissioner’s audit of . 
personal information disposal practices in selected federal institutions. The CFS 
program collects and refurbishes donated surplus computers for distribution to 
Canada’s schools, libraries, non-profit learning organizations and Aboriginal 
communities. 


Of the 414 computers reviewed, the audit concludes that every single one of them was 
properly wiped. The CFS Program’s operational procedures include sound controls to 
mitigate the risk of computers being distributed to clients with personal information 
residing on the hard drives. 


The audit results, though favourable, contained the following two recommendations 
for Industry Canada: 


Ly Industry Canada should establish a mechanism to ensure that all reported 
security weaknesses at Computers for Schools workshops are analyzed and addressed 
in a timely manner. 


2 Industry Canada should work with the Treasury Board Secretariat to request 
that federal departments and agencies provide a signed declaration to the Computers 
for Schools program certifying that all donated surplus computers and related assets 
have been cleansed of protected and classified information. 


Industry Canada’s Response: 


The CFS Program has started to work collaboratively with its licensees, the Treasury 
Board Secretariat and the RCMP to develop an action plan to address the 
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recommendations highlighted in the Commissioner’s Report. The CFS Program began 
implementation of the action plan in the fall 2010 and will continue with its 
implementation throughout fiscal year 2011/2012. 


The CFS Program has developed and launched active national outreach initiatives _ 
with government departments and agencies to inform them of their roles and 


responsibilities with regards to ensuring compliance of the Treasury Board’s Policy 
on Management of Materiel and the Directive on Disposal of Surplus Materiel. 


Office of the Auditor General of Canada 


There is nothing to report for 2010-2011. 
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APPENDIX I — STATISTICAL REPORT ON THE 
PRIVACY ACT 
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of Canada 


iv 


du Canada 


Governement 


REPORT ON THE PRIVACY ACT 


RAPPORT CONCERNANT LA LOI SUR LA PROTECTION 


DES RENSEIGNEMENTS PERSONNELS 


7 


institution 


-— 


INDUSTRY CANADA 
INDUSTRIE CANADA 


Reporting period Période visée par le rapport 


4/1/2010 to/a 3/31/2011 


Requests under the Privacy Act 
Demandes en vertu de /a Loi sur la 
protection 


Exclusions cited 
Exclusions citées 


Translations 
Traductions 


Received during reporting period 16 S. Translations requested 1 
Regues pendant la période visée par le rapport Art. 69(1)(a) Traductions demandées 
L 
Outstanding from previous period 9) (b) Translations | English to French 0 
En suspens depuis la période antérieure tL prepared De l'anglais au frangais 
Ss Traductions | French to English 


| TOTAL 


Art. 70(1)(a) 


préparées Du frangais a l'anglais 


| Completed during reporting period 
| Traitées pendant la période visée par le 


(b) 


al; 


i Carried forward 
| Reportées 


Disposition of requests completed 


Disposition a I'égard des demandes traitée: 


Method of access 
Méthode de consultation 


Copies given 
Copies de Ioriginal 


(2) |) =) || ey Cel ey | er} & 


| 
Examination | 
All disclosed (e) igi 
. Communication totale 2 | Exon Ge 
; 3 Copies and examination 
Disclosed in part (f) ; 0 
a Communication partielle 7 | Sones Chereney 
3 Nothing disclosed (excluded) 0 
! 4 Aucune communication (exclusion) 
i pee Corrections and notati 
; a__ | Nothing disclosed (exempt) 0 AVA cornetion Sue Coneetone se mention | 
| “| Aucune communication (exemption) ! Délai de traitement 
Corrections requested 
5. alia to process | D. 30 days or under 10 Corrections demandées 0 
| raitement impossible 30 jours ou moins | z 
He 7 : Corrections made 
6 Abandoned by applicant 3 31 to 60 days oy Corrections effectuées 
ib : Abandon de la demande De 31 a 60 jours 
ee —— Notation attached 
ater 2 Mahe 4 61 to 120 days 2) Mention annexée 0 
ransmission De 61 a 120 jours == = + 
f 
TOTAL 15 121 days or over 4 Costs 
121 jours ou plus ».4 Coats 
Exemptions invoked Financial (all reasons) 
Exceptions invoquées Financiers (raisons) ($000) 
Ss. Extensions Salary a 
Art. 18(2) 0 Prorogations des délais Traitement 24,901.0 
S 0 30 days or under 31 days or over Administration (O and M) 3 625 0 
Art. 19(1)(a) | 30 jours oumoins | 31 jours ou plus Administration (fonctionnement et maintien) ’ : 
b Interference with operations 
©) 0 Interruption des opérations 0 0 lle 28,526.0 
- = = = — : 
| (c) (0) Consultation 1 0 
3 See 4 ee : 
(d) 0 Translation 4 0 Person year utilization (all reasons) 
L | Traduction Années-personnes utilisées (raisons) 
S. 1 | Person year (decimal format) 
TOTAL 
| Art. 20 A 0 | 2 0 Années-personnes (nombre décimal) 0. 30 
|S. a 
| art. 21 0 
Ss. 
Art. 22(1)(a) 0 
| 
! (b) 1 
(c) 0 
S. 
Art. 22(2) 0 
S. 
Art. 23(a) 0 


Appendix B 


4, Privacy Act Me 


Treasury Board Secretariat is monitoring 
compliance with the Privacy Impact 
Assessment (PIA) Policy (which came into 
effect on May 2, 2002) through a variety of 
means. Institutions are therefore required 
to report the following information for this 
reporting period. 


Indicate the number of: 


Preliminary Privacy Impact Assessments 
initiated: 2 


Preliminary Privacy Impact Assessments 
completed: 27 __ 


Privacy Impact Assessments 
initiated:__0 


Privacy Impact Assessments 


completed:_0 


Privacy Impact Assessments forwarded to 
the Office of the Privacy Commissioner ~ 
OE ) pe 0 


If your institution did not undertake any of 
the activities noted above during the 
reporting period, this must be stated 


explicitly. 


Part III — Exemptions invoked 


Paragraph 19(1)(e) 0 
Paragraph 19(1)(f) 0 
Subsection 22.1 0 
Subsection 22.2 0 
Subsection 22.3 0 


Annexe B 


Exigences en matiére d’établissement 


de rapports supplémentaire 
Loi sur la protection des 


renseignements personnels 


Le Secrétariat du Conseil du Trésor surveille la 
conformité a la Politique sur I'Evaluation des 
facteurs relatifs 4 la vie privée (EF VP) (qui est 
entrée en vigueur le 2 mai 2002) par divers 
moyens. Les institutions sont donc tenues de 
déclarer les renseignements suivants pour cette 
période de déclaration. 


Veuillez indiquer le nombre : 


d’évaluations préliminaires des facteurs relatifs 
a la vie privée amorcées : eS 


d’évaluations préliminaires des facteurs relatifs 
a la vie privée achevées : og 


d’évaluations des facteurs relatifs a la vie 
privée amorcées: _0 


d’évaluations des facteurs relatifs a la vie 
privée achevées : 0) 


d’évaluations des facteurs relatifs a la vie 
privée acheminées au Commissariat a la 
protection de la vie privée (CP VP) : 


Si votre institution n’a pas entrepris l’une ou 
autre des activités susmentionnées durant la 
période de rapport, cela doit étre mentionné de 


Partie III — Exceptions invoquées 


Paragraphe 19(1)e) 0 
Paragraphe 19(1) f) _ 0 
Paragraphe 22.1 sO 
Paragraphe 22.2 0 
Paragraphe 22.3 0 


Part IV — Exclusions cited Partie IV — Exclusions citées 

Subsection 69.1 0 Paragraphe 69.1 0 

Subsection 70.1 0 Paragraphe 70.1 0 
Annexe C 


Appendix C 


No discrepancies to report Aucune divergence a rapporter 
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APPENDIX III — DELEGATION OF AUTHORITY 
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La. 
8 

4) 
as ¥ 
f 

ef 

[ & fi 

nN 


———s 
Sane! 


ES 


Industry Canada / Industrie Canada 


Access to Information Act and Privacy Act Delegation Order 


Arrété sur la délégation en vertu de la Loi sur l’accés a - 
(information et de la Loi sur protection des renseignements 
personnels 


The Minister of Industry Canada, pursuant 
to section 73 of the Access to Information 
Act and the Privacy Act, hereby designates 
the persons holding the positions set out in 
the schedule hereto, or the persons 
occupying on an acting basis those positions, 
to exercise the powers and functions of the 
Minister as the head of a government 
institution, under the section of the Acts set 
out in the schedule opposite each position. 
This Delegation Order supersedes all 
previous Delegation Orders. 


En vertu de l’article 73 de la Loi sur l’accés 
a l'information et la Loi sur la protection 
des renseignements personnels, le Ministre 
d’Industrie Canada délégue aux titulaires des 
postes mentionnés a ]’annexe ci-aprés, ainsi 
qu’aux personnes occupant a titre 
intérimaire les-dits postes, les attributions 
dont il est, en qualité de responsable d’une 
institution fédérale, investie par les articles 
des lois mentionnées en regard de chaque 
poste. Le présent décret de délégation 
remplace et annule tout décret antérieur. 


Schedule / Annexe 


Position / Poste 


Assistant Deputy Minister, 
Small Business and 
Marketplace Services / 
Sous-ministre adjoint(e), 
Services axés sur Je marché 
et les petites entreprises 


absolue 


Director General, 
Information Management 
Branch (IMB) / Directeur 
(trice) général, Gestion de 
)’ information (DGI) 


absolue 


Access to Information Act and 
Regulations / Loi sur I’accés a 
information et réglements 


Full authority / Autorité 


Full authority / Autorité’ 


Privacy Act and Regulations / 
Loi sur la protection des 
renseignements personnels et 
réglements 


Full authority / Autorité 
absolue 


Full authority / Autorité 
absolue 


Director, Information and Ful] authority / Autorité Full authority / Autorité 
Privacy Rights absolue absolue 

Administration (IPRA), 

Information Management 

Branch (IMB)/ Directeur 

(trice), Administration des 

droits a |’information et a la 

protection des 

renseignements personnels 

(ADIPRP), Gestion de 


l'information (DGGIJ) 

Manager, IPRA-IMB/ Full authority / Autorité Full authority / Autorité 

Gestionnaire, ADIPRP- absolue absolue 

DGGI 

and ‘ 

Senior Advisor IPRA, IMB Sections / Articles: 7, 8(1), - Sections / Articles : 8(1), 

/ Conseiller (€re) 9. 11(4\(5), 13514, 15716, Lae ero 202225. 

principal(e), ADIPRP - 17, BB AUOu2 0.S2102292 3: 24, 25, 26, 27, 28, 69, :70 
DGI 24, 25;.26,2 1(1), 68, 69 

Dated, at the City of Ottawa Date, en la ville d’Ottawa 

this 1) day of July , 20032007 cel io our de jill 2008 2007 


THE HONOURABLE MINISTER CLEMENT 
MINISTERJOF/INDUSTRY CANADAY 


MINISTRE D’ INDUSTRIE CANADA 
L’HONORABLE MINISTRE CLEMENT 
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PREFACE AND PURPOSE 


The Privacy Act (Revised Statutes of Canada, Chapter A—1, 1985) was proclaimed on 
July 1, 1983. 


The purpose of the Privacy Act “is to extend the present laws of Canada that protect the privacy of 
individuals with respect to personal information about themselves held by a government institution and 
to provide individuals with a right of access to that information” (Section 2 of the Act). The law also 
protects an individual’s privacy by preventing others from having access to that personal information 
and allows an individual specific rights concerning the collection and use of his/her information. 


Section 72 of the Privacy Act requires that the head of every government institution prepare for 
submission to Parliament an annual report on the administration of this Act within the institution 
during each financial year. 


This annual report describes how Industry Canada administered its responsibilities in the twenty-ninth 
year of operation of the Privacy Act. 


ABOUT THE ORGANIZATION 


Industry Canada’s Mission and Mandate 


Industry Canada’s mission is to foster a growing, competitive, knowledge-based Canadian economy. 
The Department works with Canadians throughout the economy, and in all parts of the country, to 
improve conditions for investment, improve Canada’s innovation performance, increase Canada’s 
share of global trade, and build an efficient and competitive marketplace. 


Industry Canada’s mandate is to help make Canadian industry more productive and competitive in the 
global economy, thus improving the economic and social well-being of Canadians. The many and 
varied activities Industry Canada carries out to deliver on its mandate are organized around three 
interdependent and mutually reinforcing strategic outcomes, each linked to a separate key strategy. The 
key strategies are shown in the illustration below. 


Prosp 


spetitiveness 


e The Canadian marketplace is efficient and competitive 

Advancing the marketplace 

Industry Canada fosters competitiveness by developing and administering economic framework 
policies that promote competition and innovation; support investment and entrepreneurial activity; and 


instill consumer, investor and business confidence. 


e Science and technology, knowledge, and innovation are effective drivers of a strong Canadian 
_ economy 


Fostering the knowledge-based economy 


Industry Canada invests in science and technology to generate knowledge and equip Canadians with 
the skills and training they need to compete and prosper in the global, knowledge-based economy. 
These investments help ensure that discoveries and breakthroughs take place here in Canada and that 
Canadians realize the social and economic benefits. 


e Competitive businesses are drivers of sustainable wealth creation 
Supporting business 


Industry Canada encourages business innovation and productivity because businesses generate jobs 
and wealth creation. Promoting economic development in communities encourages the development of 
skills, ideas and opportunities across the country. 


Context and Environment 


Industry Canada is a department with many entities that have distinct mandates, with program 
activities that are widely diverse and highly dependent on partnerships. Industry Canada works on a 
broad range of matters related to industry and technology, trade and commerce, science, consumer 
affairs, corporations and corporate securities, competition and restraint of trade, weights and measures, 
bankruptcy and insolvency, intellectual property, investment, small business, and tourism. 


Given the role the Department plays in promoting economic development and regulating the 
marketplace, there is significant public interest in the information collected and produced. Key areas of 
interest in 2011-2012 included tourism, telecommunications, small business, grants and contributions, 
G8/G20, gas pricing, as well as various statutes, namely the Competition Act, the Canada Investment 
Act and the Copyright Act, and decisions related to these Acts. 


Industry Canada also received numerous requests of a general nature, related to the overall business 
activities of the Department, such as briefings for the Minister. 


In 2011-2012 Industry Canada continued to play an important role in implementing the Government of 
Canada’s Economic Action Plan (EAP), introduced in January 2009 as part of Budget 2009. The 2011 
Budget included new investments in science and technology, as well as the commercialization and 
demonstration of new technologies in the marketplace that will help Industry Canada to succeed in its 
strategy to foster Canada's knowledge-based economy. In addition, Budget 2011 reaffirmed the 
Government of Canada's commitment to developing a digital economy strategy to encourage the 
development of a world-class digital economy in Canada, driven by innovation and enhanced 
productivity, by 2020. Advancing this strategy will involve sectors within Industry Canada, including 
the Spectrum, Information and Telecommunications Sector and the Strategic Policy Sector. Budget 
2011 also introduced a review of all policies and programs related to the aerospace/space industry to 
maximize the competitiveness of this sector. 


With this in mind and given the above mandate, the Department receives and processes a limited 
number of privacy requests each reporting period as described in this report. 


Departmental Structure 


The Department employs over 5 600 people across the country, including economists, engineers, 
scientists, commerce officers, inspectors, metrologists and accountants supported by specialists in 


areas such as human resources, financial management, communications, information management and 
information technology. 


The Department is organized into 15 sectors and branches (see www.ic.gc.ca). Industry Canada has its 
headquarters in Ottawa and several offices in the National Capital Region. The Department also has 


five regional offices (Vancouver, Edmonton, Toronto, Montreal and Halifax) as well as 10 sub-offices 
and numerous district offices. 


In addition, a number of programs have a regional presence, including those delivered by the 
Competition Bureau, Measurement Canada, the Office of the Superintendent of Bankruptcy, the 
Spectrum, Information Technologies and Telecommunications Sector and the Federal Economic 
Development Initiative for Northern Ontario (FedNor). 


Each of these sectors and branches is responsible for searching and retrieving documents responsive to 
official access requests received under the Access to Information Act and Privacy Act (ATIP). 
However, Information and Privacy Rights Administration (IPRA) is legally responsible for 
implementing and managing the ATIP program and services for Industry Canada, including decisions 
on the release or non-release of information pursuant to the legislation. 


Information Management Branch 


Given that the effective management of information is critical to the administration of the Access to 
Information Act and Privacy Act, IPRA resides with the Information Management Branch (IMB), a 
branch in the Small Business, Tourism and Marketplace Services Sector (SBTMS). IMB directs and 
supports an Information Management (IM) program to ensure the effective and efficient management 
of information within Industry Canada. The IM program provides strategic direction and services 
related to recordkeeping, public access to departmental information, departmental access to 
commercially published information and information management policy, accountability, governance, 
planning and reporting. As a result, departmental program managers can more readily deliver their 
programs and services, as well as meet their obligations under the Government’s Policy on Information 
Management, the Library and Archives Canada Act, the Access to Information Act, the Privacy Act 
and the Federal Accountability Act. Further, it ensures that the Department respects the intellectual 
property rights of commercial publishers. 


IMB provides services to the Department from four Directorates: Corporate Integrated Records 
Services (CIRS), the Library and Knowledge Centre (LKC), IM Policy, Planning and Innovation 
(IMPPI), and Information and Privacy Rights Administration (IPRA). 


Information and Privacy Rights Administration 


IPRA is responsible for the implementation and management of the Access to Information Act and 
Privacy Act programs and services for Industry Canada. Specifically, IPRA makes decisions on the 
disposition of access and privacy requests, promotes awareness of the legislation to ensure 
departmental responsiveness to the obligations imposed by law; monitors and advises on departmental 


compliance with the Acts, regulations, procedures and policies; and acts as the spokesperson for the 
Department when dealing with the Treasury Board Secretariat, the Information Commissioner, the 
Privacy Commissioner, and other government departments and agencies. IPRA is also responsible for 
conducting consultations with other federal departments with respect to access to information and 
privacy issues. 


IPRA has a complement of 15 employees including one Director, four managers, seven advisors and 
three support staff, all of whom are dedicated to processing access and privacy requests, along with 
related functions. 


Delegation of Authority 


The current Access to Information and Privacy (ATIP) Delegation Order was approved by the 
Minister in September 2011, and provides full-delegated authority to the Assistant Deputy Minister of 
SBTMS, the Director General of IMB, the Director and the managers of IPRA. The designation of the 
Assistant Deputy Minister and Director General positions is for purposes of providing strategic 
support and advice to the executive management of the Department concerning ATIP issues, if and 
when required. For all daily ATIP activities and operations, the Director and the managers of IPRA 
exercise full responsibility (see Appendix III). 


The Director of IPRA is responsible for the development, coordination and implementation of 
effective policies, guidelines and procedures to manage the Department’s compliance with the Acts. 
The administration of the legislation in Industry Canada is managed by IPRA, but is also facilitated at 
the sector, branch and regional office levels. Each sector and corporate branch has an ATIP Liaison 
Officer (reporting to an Assistant Deputy Minister, Executive Director, etc.) who coordinates activities 
and provides guidance on the administrative processes and procedures of the Acts. IPRA, which is 
located in Ottawa, responds to all formal requests submitted under the applicable Acts. 


2011-2012 Highlights 


In 2011-2012, the Department saw an increase in the volume of requests received under the Privacy 
Act as compared to the previous year. In total, 23 formal requests were received compared to 16 in 
2010-2011. However, processing privacy requests is just one component of the administration of 
privacy rights. 


Activities also include awareness, training, and the provision of advice and guidance regarding the 
collection and management of personal information within Industry Canada. IPRA also reviews and 
approves Privacy Impact Assessments (PIAs) which are core documents of the Department’s 
governance framework for IT projects. In addition, departmental officials regularly consult with IPRA 
to seek guidance on the rules related to consistent use and/or disclosure of information in accordance 
with the purpose for which the information was obtained or compiled. 


Resources — Human and Financial 


In 2011-2012, IPRA continued to face challenges in performing its daily operations and meeting its 
legal compliance requirements. Although IPRA continues to operate within an allocation of 15 full- 
time employees, 11 temporary resources were provided from across the Department to assist with the 
workload for the period of October 2011 to March 2012. As a result, a temporary operational structure 


was implemented in October 2011 to better meet the increasing business demands and allow IPRA to 
address the significant backlog of access files. IPRA consists of four teams, with three teams 
responsible for the daily operations and one for policy and outreach (see Appendix II). 


Providing interesting work and opportunities for growth are critical to retaining employees and 
lowering the departure rate. To attract and retain employees in a highly competitive market, IPRA 
provides career progression opportunities with the use of the ATIP Professional Development Program 
(ATIP-PDP). The Program, which has been in effect since 2005, is used to develop employees from 
the PM-01 to the PM-04 level within the ATIP function. 


The Program’s objective is to provide management with a tool to recruit, train and retain resources 
interested in building a career in the ATIP field. The program has proven effective in the recruitment 
and development of resources. It has also reduced the number of lengthy staffing processes and actions, 
and has had a positive influence on retention and succession planning. In 2011-2012, one IPRA 
employee was participating in the program. IPRA has also been innovative in using inter-departmental 
staffing processes and other recruitment/staffing tools, which have improved recruitment outcomes. 


IPRA also supports employees’ career objectives by providing training opportunities to support both 
short and long-term career goals. 


Resources and Workload 


Of the 15 IPRA positions, most were staffed for the majority of the reporting period. The 15 positions 
consisted of the Director, four managers (PM-06), three senior advisors (PM-05), three advisors at the 
PM-04 level and one at the PM-03 level, plus three support positions (PM-02, PM-01 and AS-01). 
During the period under review IPRA had to contend with a number of resourcing issues, not least of 
which was the departure of four staff members in the third and fourth quarters of the year. During part 
of the reporting period, two consultants were hired to assist with the workload, but only for a period of 
four weeks. 


In 2011-2012, the policy and outreach unit, usually consisting of two people (PM-06 and PM-05), was 
responsible for maintaining the various partnerships with other functional areas, overseeing various 
projects/initiatives (e.g., ATIP case management tool, Info Source Renewal, etc.), and delivering ATIP 
advice/guidance including providing training and awareness sessions across the Department. Due to 
operational changes, the unit was reduced to one person. Even with the reduction, the following 
activities were completed: 


TOTAL 
(Questions/Reviews 
/Emails, etc.) 


ACTIVITY 


Provide ATIP guidance and advice to Industry Canada officials, 
OGDs and the public 


Review of audit and evaluation reports prior to being publicly 
posted on the departmental website 
Review of parliamentar questions and responses 


Review of proactive disclosures prior to being publicly posted on 
the departmental website 


Prepare and deliver ATIP training/awareness sessions to 


Review of assessments for possible Privacy Impact Assessments 15 
(PIA) 


Review and approve Privacy Impact Assessments (PIA) 
OTHER 
Update to IPRA Internet and Intranet sites 


departmental officials (including regions by remote) 
Develop and implement new public proactive disclosure site for 
Completed ATI requests 
Prepare and table annual reports and statistical reports 
Provide input to MAF and DPR (ATIP user fees) 


Manage Info Source updates and providing submission to TBS 


Review and update business practices and procedures for IPRA 
Participate in various initiatives across IC (IM best practices in 
support of ATIP, defining ATIP roles and accountabilities, etc.) 


Other Activities 


Data-Matching and Data-Sharing Activities 


This Department is not active in any data-matching or data-sharing activities and as a result, there are 


no activities of this nature to report for 2011-2012. 


Privacy Impact of any Legislative, Policy and Service Delivery Initiatives (Including Data-Matching 


and Data-Sharing Agreements) 


There is no information to report with regard to this item for 2011-2012. 


IPRA — ATIP Procedures, Business Practices, and Policies 


To improve the administration of the ATIP program, and to ensure that Treasury Board ATIP policies 
are respected and implemented, IPRA has developed various internal guidelines, procedures, and 


business practices. The areas covered include the following: 
OPERATIONAL PROCEDURES 


ATIP Procedures for IPRA Staff 


A guide of the ATIP Office’s business practices and procedures was developed to reduce the learning 
curve of new employees, as well as to provide a reference tool for staff. During development, existing 
ATIP business processes were reviewed and challenged in an attempt to reduce administrative burden 


and improve the day-to-day workflow of the office. 


Helping Applicants through Duty to Assist 


Over the years, IPRA has implemented various approaches to better assist and respond to applicants. 
Established practices include the following: 


e The applicant’s identity is not considered during the processing of a request, nor is it revealed to 
departmental officials, unless there is a need to know to retrieve information and/or if consent is 
provided by the applicant; 

e Regular communication is established with applicants to assist in clarifying and narrowing requests, 
provide updates and explain the request process and rights pursuant to the Act; 

e Accurate, timely and complete responses are compiled in good faith. Alternate solutions may be 
suggested, such as previously released, or publicly accessible information, and, if applicable, 
referrals to other organizations involved; 

e Records are provided in the format requested. Since 2001, IPRA has been providing processed 
documents on CD-ROM in PDF format to the applicant. At times, releases of data extracts are 
provided in Excel and/or ASCII format and if the material is less than 50 pages, a paper copy is 
provided; and 

e Other practices involve facilitating discussions and/or meetings with program officials and 
providing interim responses when possible. 


BUSINESS PRACTICES IN SUPPORT OF TBS POLICIES 
Privacy Impact Assessments (PIA) 


When the PIA Policy came into effect and was later amended to a directive, IPRA established the 
following process for Industry Canada: 


1. PIA is prepared by the responsible Sector/Project Manager, 

2. PIA is forwarded to IPRA for review, discussion, approval and reporting purposes; 

3. Once a PIA is finalized and approved, IPRA provides a copy to the Office of the Privacy 
Commissioner (OPC) for review, as required; 

OPC will return the PIA with recommendations, as required, 

IPRA will return the PIA with recommendations to the Sector/Project Manager for action; 
IPRA will liaise between the Department and OPC as required until the PIA is finalized; 
Once complete, the Sector/Project Manager is to prepare a brief summary of the PIA for 
publication purposes and/or posting on the websites; and, 

IPRA will report on all PIAs at the end of each fiscal year in the Department’s Annual Report to 
Parliament on the Administration of the Privacy Act. 


ee 


0 


During this reporting period, a total of 15 assessments were completed and it was determined that no 
formal PIAs were required. The assessments consisted, for the most part, of updates to existing 
electronic tools/applications related to existing programs and initiatives, and based upon legislative 
requirements. It was also determined that the assessments described enhanced tools with little change 
to content and that there was no change to the purpose, collection, use, disclosure and retention of 
personal information, if applicable. 


In addition, it was concluded that the content was related to commercial/business information required 
by the Department to deliver on its mandate. Personal information in these cases consisted of a name 


and contact information, which was a business address required for communication purposes. 
Therefore, no formal PIAs were required, and none forwarded to the Office of the Privacy 
Commissioner. 


Use of CDs 


This initiative has reduced paper burden and eliminated reproduction fees and on-site visits from 
applicants, as well as improved timeliness and efficiency in managing the ATIP program and services. 
The Department does not charge for CDs. 


Informal Practices 


Consistent with the principle that the Act is intended to complement, rather than replace, existing 
procedures for access to government information, informal requests may be addressed directly to 
branches within the Department. IPRA routinely directs requesters to the relevant sectors with public 
research centers or public sites. 


Publicly Accessible Information, Website and Enquiry Points 


The Department is broad and diverse in nature and manages various distinct laws that legally allow for 
publicly accessible information. Industry Canada has a comprehensive website and provides a number 
of enquiry points where the public may submit a query and obtain information on an informal basis, 
specifically: 

ic.gc.ca 

Canada Business 

Canadian Consumer Information Gateway 

Canadian Intellectual Property Office 

Corporations Canada 

Office of the Superintendent of Bankruptcy 

Competition Bureau 


YFYYVYVYY"Y¥ 


ATIP Website 


IPRA also has its own Internet site (www.ic.gc.ca/eic/site/atip-aiprp.nsf/eng/home). 
The site contains general information, points of contacts and links to other key departments and 
agencies, including the ATIP Offices for the Industry Portfolio. 


Info Source 


IPRA is responsible for providing a full accounting of the Department’s information holdings to the 
Treasury Board Secretariat (TBS) and it ensures that updates are provided on a timely basis for 
inclusion in Info Source. 


In 2011-2012, a review and update of the Department’s Info Source Chapter was completed with the 

collaboration of program officials. The revised 2011-2012 Chapter contains complete descriptions of 
all IC functions, programs, activities and related holdings linked to Industry Canada’s 2011 Program 

Activity Architecture. All of the Department’s institution-specific Personal Information Banks (PIBs) 
were reviewed and updated. 


Info Source may be obtained through public and academic libraries, or may be viewed online at 
www. infosource.gc.ca/index-eng.asp. 


Reading Rooms 


A reading room is available at Industry Canada headquarters and in all regional offices as required. 
Current departmental manuals are available for review by the public upon request. The manuals may 
also be provided electronically. 


Strategies and Initiatives to Ensure Compliance 
Ensuring Compliance through Training and Outreach 


Enhanced awareness and knowledge of ATIP obligations on the part of departmental officials 
improves compliance with legal obligations, turnaround times, and the quality of responses. During the 
reporting year, IPRA continued to work closely with various program areas of the Department to 
improve compliance and address issues related to privacy and overarching IM concerns. 


In 2011-2012, there was a 58 percent increase in ATIP awareness sessions prepared and delivered to 
Industry Canada employees (57 sessions as compared to 36 in 2010-2011), with approximately 1 032 
participants (including regional participation via teleconference). A number of sessions were delivered 
to senior management across the department highlighting information management and the impact to 
ATIP as well as defining responsibilities and accountabilities. In addition, upon request, sessions were 
tailored to suit the needs of specific groups. 


Ongoing training was provided to Sector Liaison Officers, and sessions were provided to new 
employees, as part of the departmental orientation program. To date, awareness and training sessions 
have resulted in increased cooperation and collaboration with program officials across the Department. 
In some cases it has allowed improved negotiations with applicants to reduce the scope and volume of 
work, and has also improved the overall productivity and performance in managing the ATIP programs. 
In addition to these formal sessions, an Intranet site and wiki were used to create awareness and 
disseminate information to employees. 


Quarterly meetings with Sector Liaison Officers were established in order to provide regular updates 
and discuss ATIP issues. 


IPRA also participated and contributed to the Department’s IM Community of Practice, launched in 
July 2010, which provides a forum of discussion related to the development and implementation of 
Information Management best practices within Industry Canada in support of business and 
accountability. 


IPRA also worked with partners across the Department to develop and deliver a more integrated IM 
outreach program to departmental officials. Messages highlighted the connections and inter- 
dependence existing between the ATIP functions and information management activities such as 
security classification, retention/disposal and business value of information, as well as providing 
practical tips and best practices. 
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Mitigating Risk of Inappropriate Use and Disclosure of Information 


Over the past years, in an effort to mitigate the risk of releasing information that should be protected 
and to ensure the balance of privacy and right of access, IPRA has provided a number of services to 
the following core administrative functional areas: 


Comptrollership and Administration Sector (CAS) 

e As part of the government’s policy on the mandatory publication of travel and hospitality expenses 
for selected government officials (proactive disclosure), IPRA reviews the information regarding 
travel and hospitality expenses before it is posted publicly on the departmental website. The review 
ensures that no personal information is included in the information. 


Chief Informatics Office (CIO) 

e The governance framework for IT projects includes Threat and Risk Assessments and Privacy 
Impact Assessments (PIAs) among the core documents. IPRA is responsible for reviewing and 
approving the PIAs, and for providing advice to departmental officials regarding their content. 
IPRA is also responsible for reviewing assessments to determine if PIAs are required. 


Human Resources Branch (HRB) . 


e Providing general advice and guidance concerning privacy issues related to employees; 


reviewing reports such as harassment/grievance/disciplinary to ensure the balance of privacy 
and right of access. 


ATIP Case Management Tool 


IPRA implemented a new electronic ATIP Case Management tool (Axcess-1) in November 2011. This 
new tool has improved monitoring and tracking of requests and facilitates increased reporting 
requirements, thereby allowing IPRA to manage its day-to-day workflow more effectively. 


PRIVACY — TRENDS AND STATISTICS 


Significant Trends 


As stated earlier, Industry Canada’s mandate is focused on Canadian businesses. The Department’s 
programs and initiatives assist in building a more productive, competitive and knowledge-based 
economy for Canada. As a result, there are few privacy requests and issues. 


In total, 23 formal requests were received compared to 16 in 2010-2011. The few privacy requests 
received involved issues related to staffing exercises (such as rating guides and screening processes), 
performance, personal comments and bankruptcy files held by the Office of the Superintendent of 
Bankruptcy. This is in keeping with previous years. 


Statistical Report — Interpretation and Explanation 


A summarized statistical report on Privacy Act requests processed from April 1, 2011 to March 31, 


2012, is found in Appendix J. An explanation and interpretation of information contained in the 
appendix follows. 
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Part 1 — Requests Received under the Privacy Act 
Of the 26 requests processed during this reporting period, three were outstanding from previous years 


and 23 requests were new. Three requests were carried forward into the new fiscal year. A total of 23 
requests were completed and 6 333 pages processed. 


Part 2 — Requests Closed during the Reporting Period 


2.1 — Disposition and Completion Time 
23 requests were completed during the 2011-2012 reporting period, categorized as follows: 


All Disclosed — in five cases, the requester was granted full access. 
Disclosed in Part — in 11 cases, the requesters were granted partial access. 
All exempted/excluded — none to report. 

No records — in four cases, no information was found to exist. 

Request abandoned — three requests were abandoned by applicants. 

2.2 — Exemptions 


As noted in Appendix I, the Department invoked exempting provisions pursuant to sections 22, 26 and 
27 of the Privacy Act. 


2.3 - Exclusions 
The Department did not invoke any exclusion pursuant to the Act. 
2.4 —- Format of Information Released 


In 16 of the 23 requests, copies of the records were provided to the applicants on paper (6) or on CDs 
(10). There was no request for on-site examination, or other formats. 


2.5 — Complexity 
2.5.1 — Relevant Pages Processed and Disclosed 


In completing the 23 requests, a total of 6 333 pages were processed and 3 978 pages released in part 
or in full to the applicants. 


2.5.2 — Relevant Pages Processed and Disclosed by Size of Requests 


Of the 23 requests completed, four had no records and of the remaining, 70 percent of the requests 
processed (16) involved 3 978 pages disclosed. 


2.5.3 — Other Complexities 


In six of the 23 completed requests, complexity was due to consultations with other institutions (3) and 
inter-woven information (3). 


2.6 — Deemed Refusals 

2.6.1 — Reasons for Not Meeting Statutory Deadline 

Of the 23 completed cases, the Department was able to respond within the legislated 30 to 60 days, 
78 percent of the time (18 requests). However, five requests were completed past the legal due dates 
due to workload and internal consultations. 

2.6.2 — Number of Days Past Deadline 

Of the five requests noted above, three could not be legally extended and were completed within 
30 days after the legal due date. The remaining two requests were completed within 61 to 180 days 
after the legal due date. 

2.7 — Requests for Translation 

No translation was undertaken for this reporting period. 


Part 3 — Disclosures Under Subsection 8(2) 


Section 8(2)(e) — disclosure made to an investigative body (as described in the Regulations): one 
request was received during this reporting period. 


Section 8(2)(m) — disclosure in the public interest: No disclosure was made during this reporting 
period. 


Part 4 — Requests for Correction of Personal Information and Notations 

No request for corrections or notation was received for this reporting period. 

Part 5 — Extensions 

5.1 — Reasons for extensions and disposition of requests 

Of the 23 completed cases, 13 percent of completed cases (3) required extensions under the Act to 
allow external consultation with other government institutions. Of these three cases, two were 
disclosed in part and one was all disclosed to the applicants. 


5.2 — Length of Extensions 


In keeping with the Privacy Act, the three legal extensions taken were for no longer than 30 days each 
for a maximum legislated response time of 60 days per request. 
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Part 6 — Consultations Received from Other Institutions and Organization 
6.1 — Consultations received from other government institutions and organizations 


Two consultation requests were received from other government institutions (total of 24 pages) and 
none received from other organizations. 


6.2 — Recommendations and completion time for consultations received from other government 
institutions 


The two consultations were completed within 15 days of receipt. One recommendation was to release 
fully and the other was to disclose in part. 


6.3 — Recommendations and completion time for consultations received from other organizations 


There is nothing to report for 2011-2012. 


Part 7 — Completion Time of Consultations on Cabinet Confidences 


There is none to report for this reporting period. 


Part 8 — Resources Related to the Privacy Act 


8.1 — Costs 


Total salary costs associated with IPRA administering Privacy Act activities amounted to $21 254 for 
this reporting period. Non-salary costs amounted to $2 671 for a total cost Of $23.92). 


In addition to the above, administrative costs for program officials across the Department associated 
with retrieving and providing the information to IPRA amounted to $4 590. Overall costs associated to 
administering the Privacy Act at Industry Canada totalled $28 515. 


8.2 — Human Resources 
The associated human resources required to fulfill this function amounted to less than one full-time 
employee (0.3). In addition to the above, departmental program officials required to retrieve and 


provide the information to IPRA amounted to less than one full-time employee (0.1) used to complete 
the work during the reporting period. 


Overall total human resources required to administer the Privacy Act at Industry Canada is less than 
one full-time employee (0.4). 
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Complaints, Investigations and Appeals 

Applicants have the right of complaint pursuant to the Act and may exercise this right at any time 
during or after the processing of their request. The Department received two complaints for this 
reporting period, one related to use and disclosure and the other related to exemptions invoked. The 
Department also carried forward two complaints from the previous period. 

During this period the Department completed two complaint investigations. The Privacy 
Commissioner concluded that one was well founded — resolved (use and disclosure) and the other was 
settled in the course of investigation (refusal-general); while two remain under investigation (one 


related to use and disclosure and the other related to exemption). No appeals were filed with the 
Federal Court of Canada during the reporting period. 


Changes Resulting from Issues Raised by Officers of Parliament 
Office of the Privacy Commissioner of Canada 

There is nothing to report for 2011-2012. 

Office of the Auditor General of Canada 


There is nothing to report for 2011-2012. 
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APPENDIX I —- STATISTICAL REPORT ON THE PRIVACY ACT 


Name of institution: Industry Canada 


Reporting period: 2011-04-01 to 2012-03-31 
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2.3 Exclusions 
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2.6 Deemed refusals 


2.6.1 Reasons for not meeting statutory deadline 
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PART 5 — Extensions 


5.1 Reasons for extensions and disposition of requests 
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PART 6 — Consultations received from other institutions and organizations 
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6.2 Recommendations and completion time for consultations received from other government institutions 
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PART 8 — Resources related to the Privacy Act 


8.1 Costs 


Dedicated part-time 
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APPENDIX II - DELEGATION OF AUTHORITY 


Industry Canada / Industrie Canada 
Access to Information Act and Privacy Act Delegation Order 


Arrété sur la délégation en vertu de la Loi sur l'accés 
l'information et de la Loi sur protection des renseignements 


personnels 
The Minister of Industry Canada, pursuant En vertu de l’article 73 de la Loi sur l'accés a 
to section 73 of the Access to Information l'information et la Loi sur la protection des 
Act and the Privacy Act, hereby designates renseignements personnels, le Ministre 
the persons holding the positions set out in d'Industrie Canada délégue aux titulaires des 
the schedule hereto, or the persons postes mentionnes a l'annexe ci-aprés, ainsi 
occupying on an acting basis those positions, qu’aux personnes occupant a titre 
to exercise the powers and functions of the intérimaire les-dits postes, les attributions 
Minister as the head of a government dont il est, en qualité de responsable d'une 
institution, under the section of the Acts set institution fédérale, investie par les articles 
out in the schedule opposite each position. des lois mentionnées en regard de chaque 
This Delegation Order supersedes all poste. Le présent décret de délégation 
previous Delegation Orders. remplace et annule tout décret antérieur. 


Schedule / Annexe 


Position / Poste Access to Information Act and Privacy Act and Regulations / 
Regulations / Loi sur l'accés a Loi sur la protection des 
l'information et réglements renseignements personnels et 


réglements 


Assistant Deputy Minister, Full authority / Autorité Full authority / Autorité 
Small Business, Tourism absolue absolue 
and Marketplace Services / 


Sous-ministre adjoint(e), 
Services axes sur le marché, 
le tourisme et les petites 
entreprises 


Director General, 


Information Management Full authority / Autorité 


Branch (MB) Dinecieur Full authority / Autorité absol 
(trice) général, Gestion de Ke ee | ue 


l'information (DGI 
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Director, Information and 
Privacy Rights 
Administration (IPRA), 
Information Management 
Branch (MB)/ Directeur 
(trice), Administration 
des droits a l'information 
et a la protection des 
renseignements 
personnels (ADIPRP), 
Gestion de l'information 
(DGGI) 


Manager, IPRA-IMB / 
Gestionnaire, ADIPRP- 
DGGI 


and 


Senior Advisor IPRA, 
IMB / Conseiller (ere) 
principal(e), ADIPRP - 
DGI 


Dated, at the City of Ottawa 
this day of a0 al 


SEP 0 6 2011 


Full authority / Autorité 
absolue 


Full authority / Autorité 
absolue 


Sections / Articles: 7, 
8(1), 9, 11(4)6), 13, 14, 


155 16:17 ol Sebo. 200 21- 


RIL Py GAIA AYE 
68, 69 


Full authority / Autorité 
absolue 


Full authority / Autorité 
absolue 


Sections / Articles : 8(1), 
145515. 492205219 220235, 
24-25, 26527, 28, OF; 10 


Date, en la ville d'Ottawa 


ce 


2011 


SEP 0 6 2011 


THE HONOURABLE CHRISTIAN PARADIS MINISTE 


OF INDUSTRY CANADA 


Mes 
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MINISTRE D'INDUSTRIE CANADA L'HONORABLE 
CHRISTIAN PARADIS 
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ANNEXE II - STRUCTURE ORGANISATIONNELLE DE L'ADIPRP 


L. Asselin 
Manager / Gestionnaire 
(PM-06) 


S. Tremblay 
ATIP Client-Services Officer / 
Agte de services & la clientéle de l'AIPRP 
(PM-02) 


A. Meredith 
Sr. ATIP Advisor / Conseiller Princ. 


J. Macdonald 
ATIP Advisor / Conseiller d’AIPRP 
(PM-03) 


R. Diaz-Rivas 
ATIP Advisor / Conseiller d’AIPRP 
(PM-04) 
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Temporary / Temporaire 
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Temporary / Temporaire 


C. Walton 
ATIP Advisor / Conseiller d’ AIPRP 
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Temporary / Temporaire 


A. Legault 
Temporary / Temporaire 


J. Dubé 
Temporary / Temporaire 


M. Charbonneau 
Temporary / Temporaire 


G. Schaaff 
Temporary / Temporaire 


C. Roy 
Temporary / Temporaire 


J. Semrau 
Temporary / Temporaire 


B. Brocken 
Temporary / Temporaire 


K. Eadie 
Director / Directrice 
(EX-01) 


G. Gallagher 
Exec. Asst. / Adj. Executive 
(AS-01) 


L. Praine E. Fraser 
Manager / Gestionnaire Manager / Gestionnaire 
(PM-06) (PM-06) 


B. Lovett 
ATIP Client-Services Officer / 
Agte de services 4 la clientéle de l'AIPRP 
(PM-01) 


D. Robert 
Sr. ATIP Advisor / 
Conseiller Princ. d’AIPRP 
PM-05 


M. Teske 
Sr. ATIP Advisor / 
Conseiller Princ. d’AIPRP 
PM-0 


ATIP Advisor / Conseiller d’ AIPRP 
(PM-04) 


R. Griboysky 
Manager / Gestionnaire 
(PM-06) 


G. Kenny 
Temporary / Temporaire 
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